Skip to content
OpenAdvisories

Vendor

penpot

20 known vulnerabilities.

Products

penpot 20 @penpot/mcp 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-105691

    Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color

    Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec. A user who can edi…

    penpot penpot
  • Critical 9.9
    CVE-2026-44986

    Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile

    Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.cl…

    penpot penpot