Paperclip Gem Vulnerability CVE-2026-77087: Early Warning

Severity

CRITICAL

CVSS

9.6

Affected component

paperclip (gem)

Affected versions

>= 3.1.4, < 5.2.0 or >= 3.1.4, <= 3.1.4 or >= 3.2.0, <= 3.2.0 or >= 3.2.1, <= 3.2.1 or >= 3.3.0, <= 3.3.0 or >= 3.3.1, <= 3.3.1 or >= 3.4.0, <= 3.4.0 or >= 3.4.1, <= 3.4.1 or >= 3.4.2, <= 3.4.2 or >= 3.5.0, <= 3.5.0 or >= 3.5.1, <= 3.5.1 or >= 3.5.2, <= 3.5.2 or >= 3.5.3, <= 3.5.3 or >= 3.5.4, <= 3.5.4 or >= 4.0.0, <= 4.0.0 or >= 4.1.0, <= 4.1.0 or >= 4.1.1, <= 4.1.1 or >= 4.2.0, <= 4.2.0 or >= 4.2.1, <= 4.2.1 or >= 4.2.2, <= 4.2.2 or >= 4.2.3, <= 4.2.3 or >= 4.2.4, <= 4.2.4 or >= 4.3.0, <= 4.3.0 or >= 4.3.1, <= 4.3.1 or >= 4.3.2, <= 4.3.2 or >= 4.3.3, <= 4.3.3 or >= 4.3.4, <= 4.3.4 or >= 4.3.5, <= 4.3.5 or >= 4.3.6, <= 4.3.6 or >= 4.3.7, <= 4.3.7 or >= 5.0.0, <= 5.0.0 or >= 5.0.0.beta1, <= 5.0.0.beta1 or >= 5.0.0.beta2, <= 5.0.0.beta2 or >= 5.1.0, <= 5.1.0 or < 4.2.2 or >= 2.1.0, <= 2.1.0 or >= 2.1.2, <= 2.1.2 or >= 2.1.5, <= 2.1.5 or >= 2.2.0, <= 2.2.0 or >= 2.2.1, <= 2.2.1 or >= 2.2.2, <= 2.2.2 or >= 2.2.3, <= 2.2.3 or >= 2.2.4, <= 2.2.4 or >= 2.2.5, <= 2.2.5 or >= 2.2.6, <= 2.2.6 or >= 2.2.7, <= 2.2.7 or >= 2.2.8, <= 2.2.8 or >= 2.2.9.1, <= 2.2.9.1 or >= 2.2.9.2, <= 2.2.9.2 or >= 2.3.0, <= 2.3.0 or >= 2.3.1, <= 2.3.1 or >= 2.3.1.1, <= 2.3.1.1 or >= 2.3.10, <= 2.3.10 or >= 2.3.11, <= 2.3.11 or >= 2.3.12, <= 2.3.12 or >= 2.3.15, <= 2.3.15 or >= 2.3.16, <= 2.3.16 or >= 2.3.2, <= 2.3.2 or >= 2.3.3, <= 2.3.3 or >= 2.3.4, <= 2.3.4 or >= 2.3.5, <= 2.3.5 or >= 2.3.6, <= 2.3.6 or >= 2.3.7, <= 2.3.7 or >= 2.3.8, <= 2.3.8 or >= 2.3.9, <= 2.3.9 or >= 2.4.0, <= 2.4.0 or >= 2.4.1, <= 2.4.1 or >= 2.4.2, <= 2.4.2 or >= 2.4.3, <= 2.4.3 or >= 2.4.4, <= 2.4.4 or >= 2.4.5, <= 2.4.5 or >= 2.5.0, <= 2.5.0 or >= 2.5.1, <= 2.5.1 or >= 2.5.2, <= 2.5.2 or >= 2.6.0, <= 2.6.0 or >= 2.7.0, <= 2.7.0 or >= 2.7.1, <= 2.7.1 or >= 2.7.2, <= 2.7.2 or >= 2.7.4, <= 2.7.4 or >= 2.7.5, <= 2.7.5 or >= 2.8.0, <= 2.8.0 or >= 3.0.2, <= 3.0.2 or >= 3.0.3, <= 3.0.3 or >= 3.0.4, <= 3.0.4 or >= 3.1.0, <= 3.1.0 or >= 3.1.1, <= 3.1.1 or >= 3.1.2, <= 3.1.2 or >= 3.1.4, <= 3.1.4 or >= 3.2.0, <= 3.2.0 or >= 3.2.1, <= 3.2.1 or >= 3.3.0, <= 3.3.0 or >= 3.3.1, <= 3.3.1 or >= 3.4.0, <= 3.4.0 or >= 3.4.1, <= 3.4.1 or >= 3.4.2, <= 3.4.2 or >= 3.5.0, <= 3.5.0 or >= 3.5.1, <= 3.5.1 or >= 3.5.2, <= 3.5.2 or >= 3.5.3, <= 3.5.3 or >= 3.5.4, <= 3.5.4 or >= 4.0.0, <= 4.0.0 or >= 4.1.0, <= 4.1.0 or >= 4.1.1, <= 4.1.1 or >= 4.2.0, <= 4.2.0 or >= 4.2.1, <= 4.2.1

Patched version

0.3.1

An early warning has been issued for a critical vulnerability in the Paperclip gem, tracked as CVE-2026-77087. This vulnerability, which has a CVSS score of 9.6, could allow attackers to execute arbitrary commands via DNS rebinding.

What happened

Paperclip versions before 0.3.1, when run in default local_trusted mode, reportedly fail to validate Host headers. This failure allows attackers to execute arbitrary commands through DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execute commands through the process adapter.

The vulnerability is under investigation and has not yet been exploited in the wild. The affected versions of Paperclip are extensive, covering a wide range of versions from 2.1.0 to 5.1.0, with specific exclusions noted in the threat data.

What to do about it

• Upgrade to Paperclip version 0.3.1 or higher to mitigate the risk.
• Review your local development environments to ensure they are not running vulnerable versions of Paperclip.
• Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.

How 0Day would have caught this

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Sources

• [CVE-2026-77087] CVSS 9.6 CRITICAL

Join the 0Day waitlist →

← Back to all threats