CVE-2026-47665

Received Received - Intake

Stored XSS in Penpot Design Platform via File Comments

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend applies only a length check and the frontend writes comment content directly through innerHTML, any team member who can comment on a shared file can embed HTML such as an image error handler or script that executes in the browser of every other collaborator. The attack is passive: any user who opens the comments panel on the affected file triggers script execution on the Penpot origin, allowing theft of session cookies, actions performed as the victim, and access to their files and projects. This issue is fixed in version 2.15.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-47665

Affected Vendors & Products

Vendor	Product	Version / Range
penpot	penpot	to 2.14.3 (inc)
penpot	penpot	2.15.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Penpot versions up to 2.14.3 are vulnerable to stored cross-site scripting via file comments. Attackers can inject malicious HTML or scripts into comments, which execute in other users' browsers when they view the comments panel. The backend only checks comment length, and the frontend renders content unsafely using innerHTML.

Detection Guidance

This vulnerability can be detected by checking the installed version of Penpot. If the version is 2.14.3 or lower, the system is vulnerable. Commands to check the version include inspecting the application's version info or logs.

Impact Analysis

An attacker with comment access to a shared file can steal session cookies, perform actions as the victim, or access their files and projects. The attack is passive: victims trigger execution simply by opening the comments panel.

Compliance Impact

This vulnerability could lead to unauthorized data access or actions, violating GDPR (data protection) or HIPAA (health data privacy) by exposing sensitive user data or allowing unauthorized modifications.

Mitigation Strategies

Upgrade Penpot to version 2.15.3 or later immediately. Remove or restrict access to shared files with untrusted collaborators until the upgrade is complete. Monitor for suspicious activity in comments or user sessions.

Hi! I’m here to help you understand CVE-2026-47665. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70