Skip to content
OpenAdvisories

Product · penpot

@penpot/mcp

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.3
    CVE-2026-100868

    Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge

    Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, …

    penpot penpot @penpot/mcp