CVE-2026-41679 Details

A critical vulnerability in Paperclip, a Node.js server and React UI application, allows unauthenticated remote code execution on instances running in 'authenticated' mode with the default configuration. The vulnerability exists in versions prior to 2026.416.0. The exploitation process is fully automated, requires no user interaction or credentials, and involves a chain of six API calls. The issue arises from open registration, which enables the creation of accounts without verification, and a flaw in the import authorization process that bypasses necessary checks for executing code via imported agents.

To address this vulnerability, it is recommended to disable open registration by default, require email verification for account creation, and add the necessary authorization checks to the import endpoint to ensure that only users with instance admin privileges can create new companies.