{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2026.403.0"}],"component":"paperclipai","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-gqqj-85qm-8qhf","id":"tcs_01M5KFSC0XE1R5YC0QW7Z1F6P1","modified_at":"2026-04-16T23:05:20.660841Z","published_at":"2026-04-16T22:47:40Z","references":["https://osv.dev/vulnerability/GHSA-gqqj-85qm-8qhf","https://github.com/paperclipai/paperclip/security/advisories/GHSA-gqqj-85qm-8qhf","https://github.com/paperclipai/paperclip"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-gqqj-85qm-8qhf","url":"https://osv.dev/vulnerability/GHSA-gqqj-85qm-8qhf"}],"summary":"Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email"}