A critical privilege escalation vulnerability in @paperclipai/server enables remote code execution on the host system for attackers with valid Agent API keys.

The application is susceptible to OS command injection (CWE-78) because it fails to properly sanitize the adapterConfig.workspaceStrategy.provisionCommand field. An attacker possessing an Agent API key can submit a crafted configuration to the /agents/:id endpoint, resulting in arbitrary code execution with the privileges of the server process.

A successful exploit grants an attacker full control over the host server, leading to potential data exfiltration, lateral movement within the network, and complete system compromise. Given the CVSS score of 8.8, this vulnerability represents a high risk to organizational security, as it bypasses intended trust boundaries between the agent runtime and the hosting infrastructure.

Immediate Action: Update @paperclipai/server to version 2026.416.0 or later to apply the necessary input validation fixes.

Proactive Monitoring: Review access logs for the /agents/:id endpoint for unusual API requests or modifications to workspace provisioning configurations.

Compensating Controls: Implement strict network segmentation for the server host and ensure that the service runs with the minimum necessary privileges to limit the impact of potential command execution.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the GitHub security advisory referenced by the CVE record.

Organizations utilizing Paperclip AI must prioritize patching the @paperclipai/server component to version 2026.416.0 immediately. Because the vulnerability allows for remote code execution via standard API functionality, failure to update the software exposes the underlying host infrastructure to significant risk of total compromise.