Penpot CVE-2026-100868

Requires the Penpot MCP server plugin to be running in single-user mode, where the plugin WebSocket bridge (PluginBridge.ts) is created without a host argument and defaults to binding all interfaces (0.0.0.0) with no authentication token or auth middleware. The attacker must have adjacent-network reachability (AV:A) to the WebSocket port - remote Internet exploitation is not implied. Limiting factors: exposure only in single-user mode with the MCP bridge feature active; impact is capped at plugin impersonation (intercept payloads, return forged results), not code execution; and versions binding to localhost/host are unaffected. Note the separate ReplServer /execute RCE (GHSA-22qr) is a different flaw with different conditions.

This is a genuine but modest-severity issue, not a top priority. The vendor CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N/VC:L/VI:L/VA:L, base 5.3) is internally consistent with the description: adjacent-network, unauthenticated, no user interaction, and low-not-high impact on all three of C/I/A because the flaw only lets an attacker impersonate the browser plugin over the MCP WebSocket bridge - intercepting task payloads (confidentiality) and returning forged task results (integrity), rather than achieving full compromise. No EPSS score, no CISA KEV listing, and no POC exists for THIS specific WebSocket-impersonation flaw. IMPORTANT DATA CONFLICT: the bundled advisory GHSA-22qr-rp27-j9wm describes a DIFFERENT and far more severe issue - an unauthenticated /execute RCE in ReplServer.ts (binds 0.0.0.0:4403, arbitrary Node code execution) with a working PoC - but the CVE description, CVSS vector, CWE-1327 (improper binding to all interfaces), and the fix commit b5274a44 (adds host:mcpServer.host to PluginBridge.ts WebSocketServer) all point to the lower-severity PluginBridge WebSocket flaw. The RCE PoC should NOT be attributed to this CVE. Treated on its own signals, this is a low-real-risk misconfiguration exposure gated behind adjacent-network positioning and single-user mode.

An attacker on the same LAN/adjacent network segment as a developer running Penpot's MCP server in single-user mode connects to the exposed WebSocket port (bound to 0.0.0.0 with no auth), impersonates the legitimate Penpot browser plugin, and observes MCP task payloads while injecting forged task results back to the MCP client. No public PoC exists for this WebSocket-impersonation path (the PoC in the bundled advisory targets a separate ReplServer /execute RCE endpoint).