Paperclip: OS Command Injection via Execution Workspace cleanupCommand
Date: 2026-04
Affected: npm/@paperclipai/server
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: Critical
CWE: CWE-78
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

| Field | Value | |-------|-------| | **Affected Software** | Paperclip AI v2026.403.0 | | **Affected Component** | Execution Workspace lifecycle (`workspace-runtime.ts`) | | **Affected Endpoint** | `PATCH /api/execution-workspaces/:id` | | **Deployment Modes** | All — `local_trusted` (zero auth), `authenticated` (any company user) | | **Platforms** | Linux, macOS, Windows (with Git installed) | | **Date** | 2026-04-13 | --- ## Executive Summary A critical OS command injection vulnerability exists in Paperclip's execution workspace lifecycle. An attacker can inject arbitrary shell commands into the `cleanupCommand` field via the `PATCH /api/execution-workspaces/:id` endpoint. When the workspace is archived, the server executes this command verbatim via `child_process.spawn(shell, ["-c", cleanupCommand])` with no input validation or sanitization. In `local_trusted` mode (the default for desktop installations), this requires zero authentication. Three independent proofs of exploitation were demonstrated on Windows 11: arbitrary file write, full system information exfiltration (`systeminfo`), and GUI application launch (`calc.exe`). --- ## Root Cause Analysis ### Vulnerable Code Path **`server/src/services/workspace-runtime.ts` (line ~738)** The `cleanupExecutionWorkspaceArtifacts()` function iterates over cleanup commands from workspace config and executes each via shell: ```typescript // workspace-runtime.ts — cleanupExecutionWorkspaceArtifacts() for (const command o


Mitigations:

Architectural layers (MAESTRO):