{"action":"Upgrade @penpot/mcp to 2.15.0 or later.","affected":[{"fixed":"2.15.0","introduced":"0"}],"component":"@penpot/mcp","cve_ids":["CVE-2026-45805"],"ecosystem":"npm","epss":0.00379,"exploited":false,"fixed_versions":["2.15.0"],"ghsa_id":"GHSA-22qr-rp27-j9wm","id":"tcs_01M5KERP9G50AJCVGKA3XK26BP","modified_at":"2026-09-28T03:56:37.387014434Z","published_at":"2026-05-19T19:57:36Z","references":["https://osv.dev/vulnerability/GHSA-22qr-rp27-j9wm","https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm","https://github.com/penpot/penpot"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-22qr-rp27-j9wm","url":"https://osv.dev/vulnerability/GHSA-22qr-rp27-j9wm"}],"summary":"PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE"}