CVE-2026-47665 penpot CVE debrief

Who should care

Penpot users, team members with commenting privileges, security teams responsible for monitoring and mitigating XSS vulnerabilities, operators of affected platforms, and vulnerability management teams should assess exposure and prioritize remediation. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

The CVE-2026-47665 vulnerability in Penpot allows for stored cross-site scripting (XSS) through file comments, potentially leading to script execution in the browser of other collaborators. This issue requires verification of affected versions and exposure, as well as prioritization of remediation through upgrading to version 2.15.3 or later.

• Theft of session cookies and unauthorized access to sensitive information
• Actions performed as the victim, potentially leading to data tampering or unauthorized changes
• Access to their files and projects, potentially leading to data breaches or unauthorized modifications

Technical summary

The vulnerability allows any team member who can comment on a shared file to embed HTML, potentially leading to script execution in the browser of other collaborators. This is due to the backend applying only a length check and the frontend writing comment content directly through innerHTML without sanitization. The issue requires verification of affected versions and exposure, as well as prioritization of remediation through upgrading to version 2.15.3 or later. Affected product deployments should be identified, and owners assigned for follow-up. Official advisories and CVE records should be reviewed to validate affected scope, severity, and vendor guidance.

Defensive priority

Penpot users should assess exposure and prioritize upgrading to version 2.15.3 or later. Team members with commenting privileges should be aware of the risks of embedding malicious HTML in file comments.

Recommended defensive actions

• Upgrade to Penpot version 2.15.3 or later
• Review and monitor file comments for suspicious HTML content
• Educate team members on the risks of embedding malicious HTML in file comments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the backend applying only a length check and the frontend writing comment content directly through innerHTML without sanitization. This allows for stored XSS through file comments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.