CVE-2026-47666 penpot CVE debrief

Who should care

Team members who use Penpot, administrators responsible for maintaining Penpot installations, and security teams should be aware of this vulnerability and take steps to mitigate it.

Why it matters

This vulnerability allows an attacker to inject malicious JavaScript code, which can be executed when a team member opens a file referencing the malicious font, potentially leading to theft of session cookies, actions performed as the victim, and access to their files and projects. Defenders should prioritize upgrading to version 2.15.3 or later to prevent exploitation of this vulnerability.

• Theft of session cookies and sensitive information
• Actions performed as the victim
• Access to their files and projects

Technical summary

The vulnerability is due to the platform's failure to sanitize custom font family names, which are injected into the page as HTML without proper sanitization. This allows an attacker to inject malicious JavaScript code, which can be executed when a team member opens a file referencing the malicious font. The issue is fixed in version 2.15.3. The vulnerability can be mitigated by upgrading to version 2.15.3 or later, reviewing and sanitizing custom font family names, and monitoring for suspicious activity. Team members who use Penpot, administrators responsible for maintaining Penpot installations, and security teams should be aware of this vulnerability and take steps to mitigate it.

Defensive priority

Defenders should prioritize upgrading to version 2.15.3 or later to prevent exploitation of this vulnerability.

Recommended defensive actions

• Upgrade to version 2.15.3 or later
• Review and sanitize custom font family names
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is confirmed to exist in versions up to and including 2.14.3 of Penpot. The issue is fixed in version 2.15.3. There is no evidence of exploitation in the wild. Defenders should verify that their installations are upgraded to version 2.15.3 or later to prevent exploitation of this vulnerability. The vulnerability allows an attacker to inject malicious JavaScript code, which can be executed when a team member opens a file referencing the malicious font, potentially leading to theft of session cookies, actions performed

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.