Sagilayani

**Name of the Vulnerable Software and Affected Versions** Paperclip versions prior to 0.3.1 **Description** When operating in the default local trusted mode, the software fails to validate Host headers. This allows attackers to perform DNS rebinding—a technique used to bypass the Same-Origin Policy (SOP) by changing the IP address associated with a domain name after the initial DNS lookup—to make authenticated API requests and execute arbitrary commands through the process adapter. This can be triggered if a developer visits a malicious webpage while running the software locally. **Recommendations** Update to version 0.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** kanban versions 0.1.0 through 0.1.59 cline versions prior to 2.13.1 **Description** The `kanban` npm package, used by the `cline` CLI, implements a WebSocket server on `127.0.0.1:3484` that lacks Origin header validation. Because WebSocket connections bypass Cross-Origin Resource Sharing (CORS) restrictions, any website visited by a developer can silently connect to this server. This allows a malicious site to leak sensitive real-time data, including workspace filesystem paths, git branch information, task titles, and AI agent chat messages. Furthermore, an attacker can hijack running AI agent terminals by injecting arbitrary prompts, which can lead to remote code execution (RCE), or terminate active sessions, resulting in a denial of service. The issue affects the following endpoints: - 'ws://127.0.0.1:3484/api/runtime/ws' - 'ws://127.0.0.1:3484/api/terminal/io' - 'ws://127.0.0.1:3484/api/terminal/control' **Recommendations** For kanban versions 0.1.0 through 0.1.59, validate the Origin header on all WebSocket upgrade requests to reject connections from origins other than the kanban UI. For cline versions prior to 2.13.1, update the CLI tools to a version that includes a fix. Implement a session token generated at server startup that must be provided as a query parameter for all WebSocket connections. Authenticate terminal WebSocket connections to verify the client is the legitimate kanban UI.

**Name of the Vulnerable Software and Affected Versions** Paperclip versions prior to 2026.416.0 **Description** An unauthenticated attacker can achieve full remote code execution on network-accessible instances running in `authenticated` mode with default configuration. The attack is fully automated, requires no user interaction or credentials, and involves a chain of six API calls. The issue stems from an import authorization bypass that allows an attacker to create a company and deploy an agent using a process adapter, which executes arbitrary commands via the `spawn()` function without sandboxing. Technical details of the exploitation chain include: - Creating an account via the `/api/auth/sign-up/email` endpoint, which is open by default. - Generating and self-approving a CLI authentication challenge via `/api/cli-auth/challenges` and `/api/cli-auth/challenges/<id>/approve` to obtain a persistent API key. - Bypassing authorization at the `/api/companies/import` endpoint to create a new company and configure a malicious agent adapter. - Triggering the malicious agent via the `/api/agents/<agent-id>/wakeup` endpoint to execute commands as the server's OS user. **Recommendations** Update Paperclip to version 2026.416.0. As a temporary mitigation, restrict access to the `/api/companies/import` endpoint. Disable open registration by setting the `PAPERCLIP AUTH DISABLE SIGN UP` environment variable to `true`. Require email verification for new accounts.