CVE-2026-105694

MEDIUM 5.4

Penpot: Stored XSS via Unsanitised SVG Uploads

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A victim who navigates to the asset URL executes attacker-controlled JavaScript in that origin, allowing requests and data access with the victim's Penpot session authority. This issue is fixed in version 2.18.0.

CWE	CWE-79
Vendor	penpot
Product	penpot
Published	Oct 5, 2026

Stay Ahead of the Next One

Get instant alerts for penpot penpot

Be the first to know when new medium vulnerabilities affecting penpot penpot are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

penpot / penpot

< 2.18.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/penpot/penpot/security/advisories/GHSA-xg6f-5v5x-g4w2 github.com: https://github.com/penpot/penpot/security/advisories/GHSA-wrcr-m7p8-m2c4 github.com: https://github.com/penpot/penpot/pull/10989 github.com: https://github.com/penpot/penpot/pull/11044 github.com: https://github.com/penpot/penpot/commit/c4dd04353fcf06c3e10a64e3d8e43945508ae98c github.com: https://github.com/penpot/penpot/releases/tag/2.18.0