CyberRota Analysis
AI-GeneratedThe vulnerability allows an attacker to execute arbitrary commands on the server by manipulating the fill-color value of an SVG file, which is processed by the SVG exporter in Penpot versions prior to 2.18.0. This could lead to unauthorized access or control over the system, as the commands are executed with the privileges of the exporter service. Organizations using Penpot for design and prototyping should prioritize upgrading to version 2.18.0 to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec. A user who can edit a file can store shell metacharacters in the fill color and trigger SVG export, causing commands to execute with the exporter service's privileges. The same export can be triggered through a valid public share link to a malicious file. This vulnerability is fixed in 2.18.0.