CyberRota Analysis
AI-GeneratedThe vulnerability affects Penpot versions prior to 2.15.0, where the ReplServer is bound to 0.0.0.0:4403, exposing an unauthenticated /execute endpoint that allows remote execution of JavaScript on the server. This poses a significant risk, as it enables attackers on the network to execute arbitrary code, potentially compromising the server's integrity and confidentiality. Organizations using Penpot for design collaboration should prioritize upgrading to version 2.15.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0.