npm/@penpot/mcp CVE-2026-45805: high 8.8, EPSS 0.38%

PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

Action: Upgrade @penpot/mcp to 2.15.0 or later.

npm i @penpot/mcp@2.15.0

Affected

Fixed versions

Sources

• osv: GHSA-22qr-rp27-j9wm
• https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm
• https://github.com/penpot/penpot

CVE-2026-45805 · published 2026-05-19T19:57:36Z · modified 2026-09-28T03:56:37.387014434Z · JSON