These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Penpot, an open-source design and prototyping platform, has a stored XSS vulnerability via unsanitized SVG uploads. Authenticated users with file-edit permission can upload malicious SVG files, which are then served without sanitization, allowing attackers to execute JavaScript in the context of the Penpot origin. This issue was fixed in version 2.18.0.
Penpot SSRF guard bypass via IPv6 transition addresses allows for potential exposure of response bodies and status. Penpot administrators and users should assess exposure and update to version 2.18.0 or later. The vulnerability affects webhook delivery and media download, and exploitation requires routing through a NAT64 gateway or an attacker-controlled DNS AAAA record. Cloud environments with NAT64 gate [truncated]
Penpot's MCP server plugin WebSocket bridge binds to all network interfaces without authentication in single-user mode, allowing unauthenticated attackers on adjacent networks to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client. This vulnerability has significant implications for Penpot installations, especially those exposed to adjacent networks. [truncated]
Penpot, an open-source design and prototyping platform, has a stored cross-site scripting (XSS) vulnerability in versions up to and including 2.14.3. The vulnerability is due to the platform's failure to sanitize custom font family names, which are injected into the page as HTML without proper sanitization. This allows an attacker to inject malicious JavaScript code, which can be executed when a team memb [truncated]
Penpot, an open-source design and prototyping platform, has a stored cross-site scripting (XSS) vulnerability in versions up to and including 2.14.3. The vulnerability allows any team member who can comment on a shared file to embed HTML, potentially leading to script execution in the browser of other collaborators. This issue is fixed in version 2.15.3.
Penpot, an open-source design tool for design and code collaboration, had a vulnerability in versions before 2.15.0 that allowed authenticated file editors to access internal-only endpoints through the remote image import feature. This issue was due to insufficient destination filtering in the shared HTTP client. Users of Penpot, especially those with authenticated access to file editing features, should [truncated]