GitHub Security Advisory: GHSA-265w-rf2w-cjh4
Package: @paperclipai/server (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2026.416.0
Patched in: 2026.416.0

Summary: Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution

Details:
### Summary
Paperclip contains a privilege escalation vulnerability that allows an attacker with an Agent API key to execute arbitrary OS commands on the Paperclip server host.
An attacker with an agent credential can escalate privileges from the agent runtime to the Paperclip server host.
The vulnerability occurs because agents are allowed to update their own adapterConfig via the /agents/:id API endpoint.
The configuration field adapterConfig.workspaceStrategy.provisionCommand is later executed by the server runtime using:
```
spawn("/bin/sh", ["-c", command])
```
As a result, an attacker controlling an agent credential can inject arbitrary shell commands which are executed by the Paperclip server during workspace provisioning.
This breaks the intended trust boundary between agent runtime configuration and server host execution, allowing a compromised or malicious agent to escalate privileges and run commands on the host system.
This vulnerability allows remote code execution on the server host.

### Details
#### Rootcause 
Agent configuration can be modified through the API endpoint:
```
PATCH /api/agents/:id
```
The validation schema allows arbitrary configuration fields:
```
adapterConfig: z.record(z.unknown())
```
This allows attackers to inject arbitrary keys into the adapter configuration object.
Later, during workspace provisioning, the server runtime executes a shell command derived directly from this configuration.
Relevant code path:
```
server/src/services/workspace-runtime.ts

adapterConfig.workspaceStrategy.provisionCommand
        ↓
provisionExecutionWorktree()
        ↓
runWorkspaceCommand(...)
        ↓
spawn("/bin/sh", ["-c", input.command])
```
Example logic:
```
const provisionCommand = asString(input.strategy.provisionCommand, "").trim()

await runWorkspaceCommand({
  command: provisionCommand
})
```
Inside runWorkspaceCommand the command is executed using:
```
spawn(shell, ["-c", input.command])
```
Because no validation, escaping, or allowlist is applied, attacker-controlled configuration becomes a direct OS command execution primitive.


#### Affected Files
```
server/src/services/workspace-runtime.ts
```
Functions involved:
```
realizeExecutionWorkspace()
provisionExecutionWorktree()
runWorkspaceCommand()
```

#### Attacker Model
Required privileges:
Attacker needs:
```
Agent API key
```
This credential is intended for agent automation and should not grant host-level execution privileges.
Agent credentials may also be exposed to external runtimes, plugins, or third-party agent providers. Allowing such credentials to configure host-executed commands creates a privilege escalation vector.
No board or administrator access is required.

#### Attacker Chain
Complete exploit chain:
```
Attacker obtains Agent API key
        ↓
PATCH /api/agents/:id
        ↓
Inject adapterConfig.workspaceStrategy.provisionCommand
        ↓
POST /api/agents/:id/wakeup
        ↓
Server executes workspace provisioning
        ↓
workspace-runtime.t