10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-68qg-g8mg-6pr7

GHSA-68qg-g8mg-6pr7: paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

Summary

An unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in authenticated mode with default configuration. No user interaction, no credentials, just the target's address. The entire chain is six API calls.

I verified every step against the latest version. I have a fully automated PoC script and a video recording available.

Discord: sagi03581

Steps to Reproduce

The attack chains four independent flaws to escalate from zero access to RCE:

Step 1: Create an account (no invite, no email verification)

curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email":"attacker@evil.com","password":"P@ssw0rd123","name":"attacker"}' \
  http://<target>:3100/api/auth/sign-up/email

Returns a valid account immediately. No invite token required, no email verification.

This works because PAPERCLIP_AUTH_DISABLE_SIGN_UP defaults to false in server/src/config.ts:169-173:

const authDisableSignUp: boolean =
  disableSignUpFromEnv !== undefined
    ? disableSignUpFromEnv === "true"
    : (fileConfig?.auth?.disableSignUp ?? false);   // default: open

And email verification is hardcoded off in server/src/auth/better-auth.ts:89-93:

emailAndPassword: {
  enabled: true,
  requireEmailVerification: false,
  disableSignUp: config.authDisableSignUp,
},

The environment variable isn't documented in the deployment guide, so operators don't know it exists.

Step 2: Sign in

curl -s -v -X POST -H "Content-Type: application/json" \
  -d '{"email":"attacker@evil.com","password":"P@ssw0rd123"}' \
  http://<target>:3100/api/auth/sign-in/email

Capture the session cookie from the Set-Cookie header.

Step 3: Create a CLI auth challenge and self-approve it

Create the challenge (no authentication required at all):

Miggo Vulnerability Database

→

GHSA-68qg-g8mg-6pr7

GHSA-68qg-g8mg-6pr7:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
paperclipai	npm	< 2026.410.0	2026.410.0
@paperclipai/server	npm	< 2026.410.0	2026.410.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the remote code execution vulnerability is a missing authorization check in the POST /api/companies/import endpoint. The vulnerability description details a chain of weaknesses, starting with open user registration and self-approval of API keys, which grants an attacker the initial authenticated access. The critical flaw, however, is within the companyRoutes.post(/import) function in server/src/routes/companies.ts. This function failed to verify if the user had instance administrator privileges before creating a new company via an import bundle. An attacker could exploit this by supplying a malicious .paperclip.yaml file within the import data, which defines an agent using the 'process' adapter to execute arbitrary commands on the server's operating system. The exploit is triggered by calling the /api/agents/<agent-id>/wakeup endpoint.

The patch, identified in commit ac664df8e48326135a913e97ee7ed937d913586b, addresses this primary vulnerability by adding the assertInstanceAdmin check for any 'new_company' import. Additionally, the same commit fixes several other related, but less severe, authorization bypasses in other routes (/approvals, /activity, /agents) where company-level access was not properly enforced, preventing authenticated users from performing actions outside of their own company's scope.

Vulnerable functions

companyRoutes.post(/import)

server/src/routes/companies.ts

This route handler is the core of the remote code execution vulnerability. It was missing an authorization check to ensure that only instance administrators could create new companies via the import functionality. An attacker, after creating a basic account, could call this endpoint with a specially crafted payload to create a new company and define an agent with a 'process' adapter, which executes arbitrary shell commands on the server.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

10

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-68qg-g8mg-6pr7: paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

Summary

Steps to Reproduce

Step 1: Create an account (no invite, no email verification)

Step 2: Sign in

Step 3: Create a CLI auth challenge and self-approve it

GHSA-68qg-g8mg-6pr7:

10

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Basic Information

Basic Information

10

10

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-68qg-g8mg-6pr7: paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

Summary

Steps to Reproduce

Step 1: Create an account (no invite, no email verification)

Step 2: Sign in

Step 3: Create a CLI auth challenge and self-approve it

Step 4: Create a company and deploy an agent via import (authorization bypass)

Step 5: Trigger the agent

Proof of Concept

Impact

Suggested Fixes

Critical: Unauthorized board access (the root cause)

Critical: Import authorization bypass (the RCE path)

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI