{"id":"EUVD-2026-44700","enisaUuid":"0ea6f76e-670b-3dd3-98ec-3a1bba41624b","description":"Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP\u0027s mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0.","datePublished":"Jul 15, 2026, 3:11:22 PM","dateUpdated":"Jul 15, 2026, 3:44:45 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm\nhttps://github.com/penpot/penpot/issues/9518\nhttps://github.com/penpot/penpot/commit/798ee46b4a84ee6dfc756b001f33acbe0280d62f\nhttps://github.com/penpot/penpot/releases/tag/2.15.0\n","aliases":"CVE-2026-45805\nGHSA-22qr-rp27-j9wm\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"9887be05-3aee-3029-8113-d9b20a0372a1","product":{"name":"penpot","vendor":{"name":"penpot"}},"product_version":"\u003c 2.15.0"}],"enisaIdVendor":[{"id":"6d3a2b70-25c7-3414-9a2a-5b632ebf5740","vendor":{"name":"penpot"}}],"enisaIdVulnerability":[{"id":"45950f1d-bdf4-3538-96d2-0e5e09339b05","vulnerability":{"id":"CVE-2026-45805","description":"Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP\u0027s mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0.","datePublished":"Jul 15, 2026, 3:11:22 PM","dateUpdated":"Jul 15, 2026, 3:44:45 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm\nhttps://github.com/penpot/penpot/issues/9518\nhttps://github.com/penpot/penpot/commit/798ee46b4a84ee6dfc756b001f33acbe0280d62f\nhttps://github.com/penpot/penpot/releases/tag/2.15.0\n","enisa_id":"EUVD-2026-44700\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Nov 9, 2026, 7:17:10 AM","vulnerabilityProduct":[{"id":"85d5f5c4-046b-3e48-ac4d-67ba1e8ffcac","product":{"name":"penpot","vendor":{"name":"penpot"}},"product_version":"\u003c 2.15.0"}],"vulnerabilityVendor":[{"id":"60787557-3096-3d19-bf73-e15b100b9e66","vendor":{"name":"penpot"}}]}},{"id":"4a8455b5-64fd-39d7-b534-1edeb9ca66fd","vulnerability":{"id":"GHSA-22qr-rp27-j9wm","description":"PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE","datePublished":"May 19, 2026, 7:57:36 PM","dateUpdated":"May 19, 2026, 7:57:36 PM","baseScore":0.0,"references":"https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm\nhttps://github.com/penpot/penpot\n","enisa_id":"EUVD-2026-44700\n","aliases":"CVE-2026-45805\nGHSA-22qr-rp27-j9wm\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:57:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}