CVE-2026-45805: Penpot MCP RCE Vulnerability

CVE-2026-45805 Overview

Penpot is an open-source design tool for design and code collaboration. Versions prior to 2.15.0 contain an unauthenticated remote code execution vulnerability in the Penpot MCP (Model Context Protocol) ReplServer. The server bound to 0.0.0.0:4403 and exposed an /execute endpoint without authentication. Any attacker on the adjacent network could submit arbitrary JavaScript through the code field, which was passed directly to PluginBridge.executePluginTask() and executed on the server. The issue is fixed in version 2.15.0.

Critical Impact
Any attacker on the same network can execute arbitrary JavaScript on a Penpot MCP host, yielding full compromise of confidentiality, integrity, and availability.

Affected Products

Penpot MCP mcp/packages/server component
Penpot versions prior to 2.15.0
Deployments exposing TCP port 4403 on non-loopback interfaces

Discovery Timeline

2026-07-15 - CVE-2026-45805 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45805

Vulnerability Analysis

The flaw resides in mcp/packages/server/src/ReplServer.ts within the Penpot MCP server. The ReplServer class instantiated an Express application and bound it to 0.0.0.0:4403, making the service reachable from any network interface. The /execute HTTP endpoint accepted a JSON payload containing a code field and forwarded that value to PluginBridge.executePluginTask() without authentication, authorization, or input validation. Because executePluginTask() evaluates JavaScript in the server context, an attacker gains code execution equivalent to the process running the MCP server. This weakness is classified as [CWE-749] Exposed Dangerous Method or Function.

Root Cause

The root cause is an insecure default binding combined with a missing authentication layer on a privileged execution endpoint. A Read-Eval-Print Loop (REPL) service intended for local development was published on all interfaces, and the /execute route trusted any caller to submit code for evaluation.

Attack Vector

An attacker on the same broadcast domain or routable adjacent network sends an HTTP POST request to http://<target>:4403/execute with a JSON body containing arbitrary JavaScript in the code field. The MCP server evaluates that code inside PluginBridge, yielding remote code execution without credentials or user interaction.

typescript

// Patch: Bind MCP ReplServer to localhost to prevent unauthenticated RCE
// mcp/packages/server/src/ReplServer.ts
    private readonly logger = createLogger("ReplServer");
    private readonly app: express.Application;
    private readonly port: number;
+   private readonly host: string;
    private server: any;

    constructor(
        private readonly pluginBridge: PluginBridge,
-       port: number = 4403
+       port: number = 4403,
+       host: string = "localhost"
    ) {
        this.port = port;
+       this.host = host;
        this.app = express();
        this.setupMiddleware();
        this.setupRoutes();

Source: Penpot commit 798ee46

Detection Methods for CVE-2026-45805

Indicators of Compromise

Inbound TCP connections to port 4403 from non-loopback addresses on hosts running Penpot MCP
HTTP POST requests to the /execute path containing a code JSON field
Unexpected child processes, outbound connections, or file writes originating from the Penpot MCP Node.js process
Log entries from the ReplServer logger showing task execution requests from remote clients

Detection Strategies

Inspect network telemetry for listeners bound to 0.0.0.0:4403 on Penpot hosts using ss -ltnp or equivalent
Alert on HTTP requests to /execute on port 4403 sourced from any address other than 127.0.0.1
Baseline the Penpot MCP process behavior and flag deviations such as new shells, package installers, or reverse-shell patterns

Monitoring Recommendations

Forward Penpot MCP application logs and host process telemetry to a centralized analytics platform for correlation
Enable egress monitoring on Penpot hosts to detect callback traffic that would follow successful code execution
Track deployed Penpot versions across the fleet and alert on any instance below 2.15.0

How to Mitigate CVE-2026-45805

Immediate Actions Required

Upgrade Penpot to version 2.15.0 or later, which binds the ReplServer to localhost by default
Block external access to TCP port 4403 at host and network firewalls until the upgrade completes
Audit existing Penpot MCP hosts for signs of prior exploitation before returning them to service

Patch Information

The fix is delivered in Penpot 2.15.0. The security advisory GHSA-22qr-rp27-j9wm documents the vulnerability, and commit 798ee46 adds a configurable host parameter to the ReplServer constructor defaulting to localhost. See GitHub Issue #9518 for additional context.

Workarounds

Restrict inbound traffic to port 4403 to the loopback interface using host firewall rules such as iptables or nftables
Run the Penpot MCP server inside a container or namespace that does not expose port 4403 to external networks
Place the MCP host behind a network segment that blocks lateral access from untrusted clients

bash

# Restrict TCP port 4403 to loopback only via iptables
sudo iptables -A INPUT -p tcp --dport 4403 ! -i lo -j DROP
sudo iptables -A INPUT -p tcp --dport 4403 -i lo -j ACCEPT