PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

8.8 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

• CVE-2026-45805: 0.38% estimated exploitation activity in the next 30 days; percentile 31.98 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary The MCP module's ReplServer binds to all interfaces (0.0.0.0:4403) and exposes a /execute endpoint that runs arbitrary code with zero authentication. Anyone on the network can POST JavaScript and it runs on the server. The main PenpotMcpServer was partially fixed for a similar binding issue (#8683), but ReplServer.ts was missed. Details mcp/packages/server/src/ReplServer.ts:89: Compare with PenpotMcpServer.ts:301 which correctly binds to this.host (default "localhost"): The /execute endpoint at ReplServer.ts:52-79: No auth middleware, no token check, no nothing. POST JSON with a code field and it runs. This was partially flagged in #8683 (March 2026), which noted that PenpotMcpServer.ts was binding to 0.0.0.0. PR #8686 attempted a fix but was closed without merging, and it only touched PenpotMcpServer.ts and vite.config.ts — ReplServer.ts wasn't in the diff. On current develop, ReplServer.ts line 89 still calls listen(this.port) with no host argument. PoC I ran the ReplServer…

Published by the source

19 May 2026, 19:57 UTC

Last modified by the source

28 Sep 2026, 03:56 UTC

Source last checked

26 Oct 2026, 12:52 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-22qr-rp27-j9wm

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-22qr-rp27-j9wm

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-45805

Advisory: PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
IDs: CVE-2026-45805, GHSA-22qr-rp27-j9wm
Record: https://patchnext.com/advisories/cve-2026-45805 (revision 2, source checked 26 Oct 2026, 12:52 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: @penpot/mcp 2.15.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm @penpot/mcp: affected < 2.15.0; fixed in 2.15.0

## Suggested inspection (read-only)
- `npm ls @penpot/mcp --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on @penpot/mcp.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-22qr-rp27-j9wm (OSV record GHSA-22qr-rp27-j9wm lists affected ranges: npm @penpot/mcp >=0 <2.15.0 (fixed))
- Verified: https://github.com/advisories/GHSA-22qr-rp27-j9wm (GitHub-reviewed advisory GHSA-22qr-rp27-j9wm lists affected ranges: npm @penpot/mcp >=0 <2.15.0)

Commands are suggestions: review each one before running it.