Is CVE-2026-119713 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119713?

CVE-2026-119713 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-119713

Description

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.