CVE-2026-47665: Penpot Stored XSS Vulnerability

CVE-2026-47665 Overview

CVE-2026-47665 is a stored cross-site scripting (XSS) vulnerability in Penpot, an open-source design and prototyping platform. Versions up to and including 2.14.3 render file comment content directly through innerHTML without sanitization. Any team member who can comment on a shared file can inject HTML payloads, including image error handlers or inline scripts, that execute in the browser of every collaborator who opens the comments panel. The issue is fixed in version 2.15.3 [CWE-79].

Critical Impact
Attackers with commenter privileges can execute arbitrary JavaScript on the Penpot origin in victim browsers, enabling session cookie theft, impersonated actions, and access to victims' files and projects.

Affected Products

Penpot versions up to and including 2.14.3
Penpot self-hosted deployments serving multi-tenant teams
Penpot SaaS instances where users share files across teams

Discovery Timeline

2026-08-26 - CVE-2026-47665 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-47665

Vulnerability Analysis

The vulnerability exists in the Penpot frontend comment-rendering logic. Comment content is stored as raw text on the backend and then written into the DOM using innerHTML. The backend enforces only a length check on submitted comments. No output encoding or HTML sanitization is applied before rendering. This allows any authenticated user with commenting rights to persist HTML markup that executes when other collaborators view the file.

The attack requires no additional user interaction beyond opening the comments panel on an affected file. Because the payload executes on the Penpot origin, injected script can read session cookies scoped to the application, invoke authenticated API calls, and exfiltrate file and project data belonging to the viewing user.

Root Cause

The root cause is missing output sanitization in the comment text-node renderer in frontend/src/app/main/ui/comments.cljs. The dom/set-html! call received raw user-supplied text. The patch introduces an escape-html helper in frontend/src/app/util/dom.cljs that replaces &, <, >, ", and ' with their HTML entity equivalents before insertion.

Attack Vector

An attacker requires low-privilege access to a shared Penpot file with commenting rights. The attacker posts a comment containing an HTML payload such as an <img> tag with an onerror handler. When any collaborator opens the comments panel, the injected handler fires in that user's browser session and runs on the Penpot origin.

text

   ([text]
    (-> (dom/create-element "span")
        (dom/set-data! "type" "text")
-       (dom/set-html! (if (empty? text) zero-width-space text)))))
+       (dom/set-html! (if (empty? text) zero-width-space (dom/escape-html text))))))

(defn escape-html
  "Escapes special HTML characters in a string so that it can be safely used
  as innerHTML without risk of XSS."
  [^js text]
  (when (some? text)
    (-> text
        (str/replace "&" "&")
        (str/replace "<" "<")
        (str/replace ">" ">")
        (str/replace "\"" """)
        (str/replace "'" "'"))))

Source: Penpot patch commit 29f940fb

Detection Methods for CVE-2026-47665

Indicators of Compromise

Comment records in the Penpot database containing HTML tags such as <script>, <img, <svg, or event-handler attributes like onerror= and onload=.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after opening a Penpot file comments panel.
Session cookie reuse from unfamiliar IP addresses or user agents following comment viewing activity.

Detection Strategies

Scan the Penpot comments table for entries whose content contains angle brackets or common XSS sink patterns.
Review web server and CDN logs for anomalous referrer paths from Penpot file URLs to external endpoints.
Correlate authentication events with browser telemetry to identify session token use from geographically inconsistent locations.

Monitoring Recommendations

Enable and monitor Content Security Policy (CSP) violation reports from the Penpot origin.
Alert on new outbound domains contacted by browser sessions authenticated to Penpot.
Audit comment creation events for privileged files and flag payloads containing HTML entities or script keywords.

How to Mitigate CVE-2026-47665

Immediate Actions Required

Upgrade Penpot to version 2.15.3 or later, which applies the escape-html sanitizer to comment rendering.
Invalidate active session cookies for users of shared files known to contain suspicious comments.
Audit comment histories on shared files and remove any entries containing HTML markup or script payloads.

Patch Information

The fix is committed in 29f940fb7ab521033b1e276b8285afbc3609df6c and released in Penpot 2.15.3. See the GitHub Security Advisory GHSA-vc72-6r45-q988 and the patch commit for details.

Workarounds

Restrict commenting permissions on shared files to trusted team members until upgrade is complete.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted image sources on the Penpot origin.
Instruct users to avoid opening the comments panel on files shared with untrusted collaborators until the patch is applied.

bash

# Verify the running Penpot version and upgrade via Docker Compose
docker compose exec penpot-frontend cat /var/www/app/version.txt
docker compose pull
docker compose up -d
# Confirm the deployed version is 2.15.3 or later
docker compose exec penpot-frontend cat /var/www/app/version.txt