CVE-2026-77087: Paperclip before 0.3.1 Remote Code Execution via DNS Rebinding
Paperclip before 0.3.1 in default localtrusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execute commands through the process adapter.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Developers running Paperclip locally in its default local_trusted mode are exposed if they visit an attacker-controlled webpage. The attack targets the locally running Paperclip service through DNS rebinding.
What does an attacker need to exploit it?
The attacker needs to induce a developer running the vulnerable local instance to visit a malicious webpage. No prior privileges are required, but user interaction is required.
What is the impact of a successful attack?
The malicious page can make authenticated API requests to the local Paperclip instance and execute arbitrary commands through the process adapter. This can compromise confidentiality, integrity, and availability with impact beyond the vulnerable component.
Which versions address the issue?
Paperclip versions before 0.3.1 are affected. Upgrading to 0.3.1 or later removes the stated vulnerable version range.