CVE Intelligence

Vulnerabilidades do Penpot @penpot/mcp

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Penpot @penpot/mcp: 1 registro(s), com versões afetadas e correções.

CVE-2026-100868 Média · 6.3 CWE-1327 27/09/2026
Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.