Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@penpot/mcp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8npmAmendedPublished

    PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

    CVE-2026-45805 · GHSA-22qr-rp27-j9wm

    Affected
    • npm @penpot/mcp < 2.15.0
    Fixed in
    2.15.0· Vendor fix available
    Issue
    The MCP module's ReplServer binds to all interfaces (0.0.0.0:4403) and exposes a /execute endpoint that runs arbitrary code with zero authentication. Anyone on the network can POST JavaScript and it runs on the server. The main PenpotMcpServer was partially fixed for a similar binding issue (#8683), but ReplServer.ts was missed. Details mcp/packages/server/src/ReplServer.ts:89: Compare with PenpotMcpServer.ts:301 which correctly binds to this.host (default "localhost"): The /execute endpoint at ReplServer.ts:52-79: No auth middleware, no token check, no nothing. POST JSON with a code field and it runs. This was partially flagged in #8683 (March 2026), which noted that PenpotMcpServer.ts was binding to 0.0.0.0. PR #8686 attempted a fix but was closed without merging, and it only touched PenpotMcpServer.ts and vite.config.ts — ReplServer.ts wasn't in the diff. On current develop, ReplServer.ts line 89 still calls listen(this.port) with no host argument. PoC I ran the ReplServer…

    Recommended action: Upgrade to 2.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →