Description
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| penpot | penpot | < 2.18.0 | 2.18.0 |
| penpot | @penpot/mcp | ≤ 2.15.4 | — |
References
- GitHub Security Advisory (GHSA-ch2q-6x56-qg5r) vendor-advisory
- https://github.com/penpot/penpot/commit/b5274a44766d095247037be18c1d1918ac67ddeb patch
- https://github.com/penpot/penpot/blob/1d2c37e52c733f74017d90b0fd1ae2d074a5c33d/mcp/packages/server/src/PluginBridge.ts#L52 technical-description
- GitHub Security Advisory (GHSA-22qr-rp27-j9wm) related vendor-advisory
- https://github.com/penpot/penpot product
- VulnCheck Advisory: Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge third-party-advisory