CVE-2026-105691: Penpot SVG Exporter RCE Vulnerability

CVE-2026-105691 Overview

Penpot is an open-source design and prototyping platform used by distributed teams for collaborative design work. CVE-2026-105691 is a command injection vulnerability [CWE-78] in the Penpot SVG exporter affecting versions prior to 2.18.0. The exporter embeds an attacker-controlled text object fill-color value into a ppmcolormask command string and executes it through Node.js child_process.exec. Any user who can edit a file can store shell metacharacters in the fill color and trigger SVG export to run arbitrary commands with the exporter service's privileges. The same export path can be reached through a valid public share link to a malicious file, enabling unauthenticated exploitation in shared workspaces.

Critical Impact

Remote command execution on the Penpot exporter service through a crafted text object fill color, reachable via public share links.

Affected Products

• Penpot versions prior to 2.18.0
• Penpot self-hosted deployments running the exporter service
• Penpot instances exposing public share links to editable files

Discovery Timeline

• 2026-10-05 - CVE-2026-105691 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105691

Vulnerability Analysis

The Penpot SVG exporter constructs a shell command to apply color masking during export operations. The fill-color attribute of a text object is concatenated into a ppmcolormask invocation and passed to child_process.exec, which spawns a shell to interpret the string. Because the fill color value is attacker-controlled and not sanitized, shell metacharacters such as ;, |, `, and $(...) break out of the intended argument and execute arbitrary commands.

Exploitation requires only the ability to edit a file in a Penpot project. An attacker who stores a malicious fill color and triggers export obtains command execution on the exporter host. More critically, the exporter can be invoked through a public share link pointing to a malicious file, which allows unauthenticated users on the internet to trigger the vulnerable code path.

Root Cause

The root cause is the use of string concatenation followed by shell execution for user-controlled input. The exporter did not validate that the fill-color field matched an expected color format and did not use parameterized process invocation. The patch replaces string-based exec with argument-array invocation of commands such as pdfunite, eliminating shell interpretation of file paths and other arguments.

Attack Vector

The attack requires network access to a vulnerable Penpot instance and the ability to either edit a file or follow a public share link to a malicious file. The adversary sets the fill color of a text object to a payload containing shell metacharacters, then triggers SVG export. The exporter service executes the payload with its own privileges, which typically include file system access and network reachability into internal services.

// Patch excerpt: exporter/src/app/handlers/export_frames.cljs
   [file-id paths]
   (p/let [prefix (str/concat "penpot.pdfunite." file-id ".")
           path   (sh/tempfile :prefix prefix :suffix ".pdf")]
-    (sh/run-cmd! (str "pdfunite " (str/join " " paths) " " path))
+    (apply sh/run-cmd! "pdfunite" (conj (vec paths) path))
     path))

Source: Penpot commit aa3bc1a. The fix moves from a single shell-interpreted string to argument-array invocation, preventing metacharacter injection.

Detection Methods for CVE-2026-105691

Indicators of Compromise

• Unexpected child processes spawned by the Penpot exporter service, especially shells (/bin/sh, bash) invoking non-image-processing binaries such as curl, wget, nc, or python.
• Outbound network connections from the exporter host to unknown external addresses following SVG export activity.
• Penpot files or share links containing text objects with fill-color values that include characters outside the expected hex color format.

Detection Strategies

• Monitor process ancestry on exporter hosts for node or exporter service processes spawning shells or unrelated utilities.
• Inspect Penpot application and exporter logs for export jobs triggered against files with abnormal text object attributes.
• Alert on access to public share endpoints followed closely by exporter process creation anomalies.

Monitoring Recommendations

• Enable command-line auditing on hosts running the Penpot exporter and ship events to a central analytics platform.
• Baseline the normal set of child processes spawned by the exporter and alert on deviations.
• Track network egress from the exporter service and restrict it to required destinations only.

How to Mitigate CVE-2026-105691

Immediate Actions Required

• Upgrade all Penpot deployments to version 2.18.0 or later without delay.
• Disable public share links on self-hosted instances until the upgrade is complete.
• Review existing files for text objects containing non-standard fill-color values and purge suspicious content.
• Rotate credentials and tokens accessible to the exporter service if compromise is suspected.

Patch Information

The vulnerability is fixed in Penpot 2.18.0. The maintainers replaced shell-based command construction with argument-array process invocation in the exporter. See the Penpot 2.18.0 release, the GitHub Security Advisory GHSA-4f36-m4hj-cv86, and the pull request discussion for full details.

Workarounds

• Restrict the exporter service to run under a dedicated unprivileged user with no outbound network access.
• Place the exporter in a sandboxed container with read-only file systems and seccomp profiles blocking shell execution.
• Temporarily disable the SVG export feature or public share link functionality for exposed instances until patching.

# Verify Penpot version and upgrade (Docker Compose example)
docker compose exec penpot-exporter cat /opt/penpot/version.txt
# Pull the fixed release
docker compose pull
docker compose up -d
# Confirm exporter is running 2.18.0 or later
docker compose exec penpot-exporter cat /opt/penpot/version.txt