Penpot vulnerabilities
We track 8 vulnerabilities in Penpot products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 5, 2026.
Latest Penpot vulnerabilities
- 9.9 Critical severity
penpot: Improper Neutralization of Special Elements used in an OS Command
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec. A user who can edit
- 7.6 High severity
penpot: Improper Neutralization of Input During Web Page Generation
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page
- 8.7 High severity
penpot: Improper Neutralization of Input During Web Page Generation
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without a
- 7.5 High severity
Penpot: Missing Authorization
Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.
- 7.7 High severity
penpot: Server-Side Request Forgery
Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from
- 8.8 High severity
penpot: Exposed Dangerous Method or Function
Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to Plug
- 9.9 Critical severity
penpot: Improper Authentication
Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj
- 7.5 High severity
penpot: Improper Limitation of a Pathname to a Restricted Directory
Penpot is an open-source design tool for design and code collaboration. Prior to version 2.13.2, an authenticated user can read arbitrary files from the server by supplying a local file path (e.g. `/etc/passwd`) as a font data chunk in the `create-font-variant