Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-3xx2-mqjm-hg9x
  • npm/@paperclipai/server
 Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise 16 Apr
  • Fix available
  • Severity - 9.9 (Critical)
GHSA-fpw4-p57j-hqmq
  • npm/@paperclipai/ui
 Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization 16 Apr
  • Fix available
  • Severity - 5.4 (Medium)
GHSA-p7mm-r948-4q3q
  • npm/@paperclipai/server
 Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server 16 Apr
  • Fix available
  • Severity - 4.3 (Medium)
GHSA-47wq-cj9q-wpmp
  • npm/@paperclipai/server
 Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys 16 Apr
  • Fix available
  • Severity - 9.9 (Critical)
GHSA-vr7g-88fq-vhq3
  • npm/@paperclipai/server
 Paperclip: OS Command Injection via Execution Workspace cleanupCommand 16 Apr
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-gqqj-85qm-8qhf
  • npm/paperclipai
 Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email 16 Apr
  • No fix available
  • Severity - 8.7 (High)
GHSA-xfqj-r5qw-8g4j
  • npm/@paperclipai/server
 Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode 16 Apr
  • Fix available
  • Severity - 8.3 (High)
GHSA-w8hx-hqjv-vjcq
  • npm/@paperclipai/server
 Paperclip: Malicious skills able to exfiltrate and destroy all user data 16 Apr
  • Fix available
  • Severity - 7.3 (High)
GHSA-265w-rf2w-cjh4
  • npm/@paperclipai/server
 Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution 16 Apr
  • Fix available
  • Severity - 8.8 (High)
GHSA-3pw3-v88x-xj24
  • npm/@paperclipai/shared
 Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath 16 Apr
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-68qg-g8mg-6pr7
  • npm/@paperclipai/server
  • npm/paperclipai
 paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass 10 Apr
  • Fix available
  • Severity - 10.0 (Critical)