GHSA-vr7g-88fq-vhq3

| Field | Value | |-------|-------| | **Affected Software** | Paperclip AI v2026.403.0 | | **Affected Component** | Execution Workspace lifecycle (`workspace-runtime.ts`) | | **Affected Endpoint** | `PATCH /api/execution-workspaces/:id` | | **Deployment Modes** | All — `local_trusted` (zero auth), `authenticated` (any company user) | | **Platforms** | Linux, macOS, Windows (with Git installed) | | **Date** | 2026-04-13 | --- ## Executive Summary A critical OS command injection vulnerability exists in Paperclip's execution workspace lifecycle. An attacker can inject arbitrary shell commands into the `cleanupCommand` field via the `PATCH /api/execution-workspaces/:id` endpoint. When the workspace is archived, the server executes this command verbatim via `child_process.spawn(shell, ["-c", cleanupCommand])` with no input validation or sanitization. In `local_trusted` mode (the default for desktop installations), this requires zero authentication. Three independent proofs of exploitation were demonstrated on Windows 11: arbitrary file write, full system information exfiltration (`systeminfo`), and GUI application launch (`calc.exe`). --- ## Root Cause Analysis ### Vulnerable Code Path **`server/src/services/workspace-runtime.ts` (line ~738)** The `cleanupExecutionWorkspaceArtifacts()` function iterates over cleanup commands from workspace config and executes each via shell: ```typescript // workspace-runtime.ts — cleanupExecutionWorkspaceArtifacts() for (const command of cleanupCommands) { await recordWorkspaceCommandOperation(ws, command, ...); } // recordWorkspaceCommandOperation() → const shell = resolveShell(); // process.env.SHELL || "sh" spawn(shell, ["-c", command]); ``` ### Missing Input Validation **`server/src/routes/execution-workspaces.ts` — PATCH handler** The PATCH endpoint accepts a `config` object containing `cleanupCommand` with no validation: ``` PATCH /api/execution-workspaces/:id Body: { "config": { "cleanupCommand": "<ARBITRARY_COM