GHSA-vr7g-88fq-vhq3 Paperclip: OS Command Injection via Execution Workspace cleanupCommand
| Field | Value |
|-------|-------|
| **Affected Software** | Paperclip AI v2026.403.0 |
| **Affected Component** | Execution Workspace lifecycle (`workspace-runtime.ts`) |
| **Affected Endpoint** | `PATCH /api/execution-workspaces/:id` |
| **Deployment Modes** | All — `local_trusted` (zero auth), `authenticated` (any company user) |
| **Platforms** | Linux, macOS, Windows (with Git installed) |
| **Date** | 2026-04-13 |Executive SummaryA critical OS command injection vulnerability exists in Paperclip's execution workspace lifecycle. An attacker can inject arbitrary shell commands into the `cleanupCommand` field via the `PATCH /api/execution-workspaces/:id` endpoint. When the workspace is archived, the server executes this command verbatim via `child_process.spawn(shell, ["-c", cleanupCommand])` with no input validation or sanitization. In `local_trusted` mode (the default for desktop installations), this requires zero authentication.Three independent proofs of exploitation were demonstrated on Windows 11: arbitrary file write, full system information exfiltration (`systeminfo`), and GUI application launch (`calc.exe`).Root Cause AnalysisVulnerable Code Path**`server/src/services/workspace-runtime.ts` (line ~738)**The `cleanupExecutionWorkspaceArtifacts()` function iterates over cleanup commands from workspace config and executes each via shell:Missing Input Validation**`server/src/routes/execution-workspaces.ts` — PATCH handler**The PATCH endpoint accepts a `config` object containing `cleanupCommand` with no validation:The `cleanupCommand` value is stored directly in workspace metadata and later passed to `spawn()` without sanitization, allowlisting, or escaping.Shell Resolution**`resolveShell()`** returns `process.env.SHELL` or falls back to `"sh"`:**Linux/macOS**: `/bin/sh` exists natively — commands execute immediately**Windows**: `sh.exe` is available via Git for Windows (`C:\Program Files\Git\bin\sh.exe`) — Paperclip requires Git, so `sh` is present on most installationsAttack ChainThe exploit requires 5 HTTP requests with zero authentication in `local_trusted` mode:Step 1 — Find a CompanyStep 2 — Find an Execution WorkspaceStep 3 — Reactivate Workspace (if archived/failed)Step 4 — Inject cleanupCommand (Command Injection)Response confirms storage:Step 5 — Trigger RCE (Archive Workspace)This triggers `cleanupExecutionWorkspaceArtifacts()` which calls:The injected command is executed with the privileges of the Paperclip server process.Authentication Bypass by Deployment Mode`local_trusted` Mode (Default Desktop Install)Every HTTP request is auto-granted full admin privileges with zero authentication:The `boardMutationGuard` middleware is also bypassed:`authenticated` ModeAny user with company access can exploit this vulnerability. The `assertCompanyAccess` check occurs AFTER the database query (BOLA/IDOR pattern), and no additional authorization is required to modify workspace config fields.Proof of Concept — 3 Independent RCE Proofs (Windows 11)All proofs executed via the automated PoC script `poc_paperclip_rce.py`.Proof 1: Arbitrary File Write**Payload:** `echo RCE_PROOF_595c04f7 > "%TEMP%\rce-proof-595c04f7.txt"`**Result:**Proof 2: System Command Execution (Data Exfiltration)**Payload:** `systeminfo > "%TEMP%\rce-sysinfo-595c04f7.txt"`**Result:**Proof 3: GUI Application Launch (calc.exe)**Payload:** `calc.exe`**Result:**Windows Calculator was launched on the host system by the Paperclip server process.Impact Assessment| Impact | Description |
|--------|-------------|
| **Remote Code Execution** | Arbitrary commands execute as the Paperclip server process |
| **Data Exfiltration** | Full system info, environment variables, files readable by server process |
| **Lateral Movement** | Attacker can install tools, pivot to internal network |
| **Supply Chain** | Workspaces contain source code — attacker can inject backdoors into repositories |
| **Persistence** | Attacker can create scheduled tasks, install reverse shells |
| **Privilege Escalation** | Server may run with elevated privileges; attacker inherits them |Attack Scenarios**Desktop user (local_trusted)**: Any process or malicious web page making local HTTP requests to `127.0.0.1:3100` can achieve RCE with zero authentication**Team deployment (authenticated)**: Any employee with Paperclip access can compromise the server and all repositories managed by it**Chained attack**: Combine with SSRF or DNS rebinding to attack Paperclip instances from the networkRemediation RecommendationsImmediate (Critical)**Input validation**: Reject or sanitize `cleanupCommand` and `teardownCommand` fields in the PATCH handler. Do not allow user-supplied values to be passed to shell execution.**Command allowlisting**: If custom cleanup commands are needed, implement a strict allowlist of permitted commands (e.g., `git clean`, `rm -rf <workspace_dir>`).**Use `execFile` instead of `spawn` with shell**: Replace `spawn(shell, ["-c", command])` with `execFile()` using an argument array, which prevents shell metacharacter injection.Short-term**Authorization check**: Add proper authorization checks BEFORE processing the PATCH request. Validate that the user has explicit permission to modify workspace configuration.**Separate config fields**: Do not allow the same endpoint to update both workspace status and security-sensitive configuration fields like commands.Long-term**Sandboxed execution**: Run cleanup commands in a sandboxed environment (container, VM) with minimal privileges.**Audit logging**: Log all modifications to command fields for forensic analysis.**Security review**: Audit all `spawn`, `exec`, and `execFile` calls across the codebase for similar injection patterns.Proof of Concept ScriptScript[poc_paperclip_rce.py](https://github.com/user-attachments/files/26697937/poc_paperclip_rce.py)The full automated PoC is available as `poc_paperclip_rce.py`. It:Auto-detects deployment mode and skips auth for `local_trusted`Discovers company and workspace automaticallyReactivates failed/archived workspacesOn Windows, auto-locates `sh.exe` from Git and restarts Paperclip if neededRuns 3 independent RCE proofs: file write, systeminfo, calc.exeWorks on Linux, macOS, and Windows**Usage:**
CVSS v3.1 score: 9.8