CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119713?
CVE-2026-119713 is a high-severity vulnerability in @paperclipai/server, published on 30 Oct 2026.
Official description
Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.
Weakness: CWE-78
Which versions are affected by CVE-2026-119713?
1 open source package ship an affected version, including @paperclipai/server.
| Package | Affected | Fixed in |
|---|---|---|
@paperclipai/server npm | All versions | 2026.416.0 |
How do I fix CVE-2026-119713?
Upgrade @paperclipai/server to 2026.416.0 or later.
Is CVE-2026-119713 being exploited?
There is no known exploitation of CVE-2026-119713 in the wild and no public exploit code.
Sources
Also known as GHSA-832j-x75x-r6jc, GHSA-vr7g-88fq-vhq3.