Cross-Site Scripting Vulnerability in Penpot Design Platform

CVE-2026-105694

What is CVE-2026-105694?

Penpot, an open-source design and prototyping platform, is susceptible to a cross-site scripting vulnerability. Authenticated users with file-edit permissions can upload SVG media containing unsanitized scripts and event-handler attributes. When another user accesses the asset URL, the malicious scripts execute within the victim's session context, enabling unauthorized data access and requests. This vulnerability was addressed in Penpot version 2.18.0, and users are encouraged to upgrade to the latest version to mitigate potential risks.

References