Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
Priority HIGH 73CWE-749Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix Fixed penpot (penpot): 2.15.0@penpot/mcp (npm): 2.15.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| penpot | penpot | before 2.15.0 | 2.15.0 | Patch available | CNA |
| — | @penpot/mcp (npm) | before 2.15.0 | 2.15.0 | Patch available | GHSA-22qr-rp27-j9wm |
- penpot Vendorpenpot Affected before 2.15.0 Fixed in 2.15.0 Patch available CNA
- @penpot/mcp (npm) Vendor— Affected before 2.15.0 Fixed in 2.15.0 Patch available GHSA-22qr-rp27-j9wm
Remediation
- Fix · CNA penpot (penpot) Fixed in 2.15.0
- Fix · GHSA-22qr-rp27-j9wm @penpot/mcp (npm) Fixed in 2.15.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-45805
- 2026-10-03 Alias added: GHSA-22qr-rp27-j9wm
References
More penpot vulnerabilities
- TI-2026-68335 OS command injection in Penpot SVG exporter via fill color CVSS 3.1CRITICAL 9.9
- TI-2026-32845 Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile CVSS 3.1CRITICAL 9.9
- TI-2026-35172 Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML CVSS 3.1HIGH 8.7
- TI-2026-14441 Missing authorization in Penpot CVSS 3.1HIGH 7.5
- TI-2026-33541 Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url CVSS 3.1HIGH 7.7
- TI-2026-68333 SSRF guard bypass in Penpot via IPv6 transition addresses CVSS 4.0MEDIUM 6.0
Sources
- CVE-2026-45805 · CVE Program
- CVE-2026-45805 · NVD
- FIRST EPSS
- GHSA-22qr-rp27-j9wm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences