EUVD-2026-92709Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain file edit access or public share link
-
DeliveryStore shell metacharacters in text fill-color
-
ExploitTrigger SVG export
-
ExecutionValue injected into ppmcolormask exec call
-
PersistArbitrary commands run as exporter service
-
ImpactExporter host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that an attacker be able to set a text object's fill-color value in a Penpot file (edit access to the file) and then trigger an SVG export; the malicious fill color is passed unsanitized into the ppmcolormask command string executed via child_process.exec. Two reachability paths exist: (1) an authenticated user with file edit rights (matching CVSS PR:L), and (2) triggering the export of a malicious file through a VALID PUBLIC SHARE LINK, which broadens reach to anyone holding the link. LIMITING FACTORS: the affected component is the separate SVG exporter service, so only deployments that expose SVG export (and, for the share-link path, that enable public share links to attacker-authored files) are exploitable; execution privileges are bounded by the exporter service account. Only Penpot versions prior to 2.18.0 are affected. |
| Impact | This is a genuine high-priority vulnerability, not an inflated CVSS score. The CWE-78 OS command injection arises from an attacker-controlled SVG fill-color value being concatenated into a ppmcolormask command string and passed to child_process.exec, yielding direct code execution with the exporter service's privileges. The input CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) is consistent with the description: the payload is planted over the network by a user with edit rights (PR:L), requires no user interaction, and the scope change (S:C) reflects code execution crossing into the separate exporter service. No EPSS score, KEV listing, or public POC was provided in the input; per the precision rules this is 'no public exploit identified at time of analysis.' The dangerous amplifier is the public-share-link vector: an export of a malicious file can be triggered via a valid public share link, meaning the trigger step may not require authentication even though planting the payload (PR:L) does. CONFLICT TO VERIFY: CVSS encodes PR:L, but the share-link trigger path implies a near-unauthenticated reachability in shared/public deployments - defenders running public share links should treat effective exposure as higher than PR:L alone suggests. Absent EPSS/KEV data, widespread exploitation cannot be asserted, but the low complexity and fixed patch make prompt upgrading to 2.18.0 warranted. |
| Exploit ScenarioDerived | An attacker with edit access to a Penpot file (or who creates a malicious file exposed via a public share link) sets a text object's fill color to a value containing shell metacharacters. When the SVG export runs, that value is interpolated into a ppmcolormask command executed through child_process.exec, running attacker commands on the exporter service. No public exploit code is identified at time of analysis, but the fix commit/PR (penpot #11272) publicly reveals the vulnerable code path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Authenticated command injection in the Penpot SVG exporter prior to 2.18.0 allows a user with edit rights on a design file to place shell metacharacters in a text object's fill-color value, which the exporter interpolates unsanitized into a ppmcolormask command string and runs via child_process.exec, resulting in arbitrary command execution with the exporter service's privileges. The CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a scope change that crosses from the Penpot application into the underlying exporter host, with high confidentiality, integrity, and availability impact there. A second reachability path exists through a valid public share link to a malicious file, which lets anyone holding the link trigger the export without being an authenticated editor; no public exploit code has been identified at time of analysis, and the issue is fixed in 2.18.0.
RemediationAI
Upgrade to Penpot 2.18.0 or later (Vendor-released patch: 2.18.0), available from https://github.com/penpot/penpot/releases/tag/2.18.0, and verify the applied change against commit aa3bc1ae984577f0354d4270d2546e15985f4bcf per advisory GHSA-4f36-m4hj-cv86. If immediate upgrade is not possible, apply compensating controls that target the two reachability paths: disable or stop the standalone SVG exporter service entirely if SVG export is not a business requirement (this eliminates the attack surface but removes all SVG export functionality), and disable public share links for untrusted or externally authored files (this closes the unauthenticated link-based path but degrades collaboration and review workflows). Because the exploit executes as the exporter service account, run the exporter under a dedicated low-privilege user with no write access outside its working directories and no unnecessary outbound network access, accepting that this bounds rather than removes the injected-command capability. Additionally, restrict file edit rights to trusted users and monitor the exporter process for unexpected child processes or outbound connections as a detection measure; note that no public exploit code has been identified at time of analysis, so these measures are precautionary rather than response to observed exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-78 (improper neutralization of special elements used in an OS command), specifically an OS command injection rather than a pure code-evaluation flaw. Penpot's exporter is a standalone service (evidenced by the repository's exporter/ directory, its ClojureScript/shadow-cljs build and dedicated CI workflow) that renders design files into output formats. During SVG generation, a solid fill color on a text object is fed into ImageMagick's ppmcolormask utility via a constructed shell command string; because that string is passed to Node's child_process.exec, which invokes a shell, any shell metacharacters stored in the attacker-controlled fill-color value are interpreted by that shell instead of being treated as literal color data. CPE cpe:2.3:a:penpot:penpot:*:*:*:*:*:*:*:* with a wildcard version, combined with the advisory statement that the flaw is fixed in 2.18.0, indicates every release before that version carries the vulnerable exporter. The scope change in the assessed vector (S:C) is consistent with execution moving from the Penpot web application's authority into the exporter service's process context, and PR:L confirms the primary path requires an authenticated user who can modify file content, with the public-share-link path acting as an additional, more broadly reachable trigger.
Know when Penpot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Payload is planted over the network by a user with edit rights (PR:L) with no interaction (UI:N); command execution crosses into the separate exporter service (S:C) giving full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec. A user who can edit a file can store shell metacharacters in the fill color and trigger SVG export, causing commands to execute with the exporter service's privileges. The same export can be triggered through a valid public share link to a malicious file. This vulnerability is fixed in 2.18.0.
Technical POC Analysis
CWE-78, OS Command Injection.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A critical command-injection flaw in Penpot's SVG exporter (CVE-2026-105691, CVSS 9.9) allows anyone with edit rights on a design file - or merely a valid public share link - to execute arbitrary commands on the underlying export server when an affected file is rendered. Because the flaw crosses from the design application into the host system with full confidentiality, integrity, and availability impact, a single malicious file could expose design assets and connected data, tamper with exports, or take the export host offline. Penpot is fixed in version 2.18.0, so organizations running earlier releases should treat this as a priority remediation item affecting both internal design teams and any externally shared designs.
Apply vendor patch (upgrade to Penpot 2.18.0). If the upgrade cannot be completed immediately, interim mitigations are: disable or restrict public share links, restrict design-file edit rights to trusted users, run the exporter service as a low-privilege isolated account or container with egress filtering, and monitor the exporter host for unexpected command execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Penpot before version 2.13.2 contains a path traversal vulnerability in the font creation endpoint that allows authentic
Account takeover in Penpot before 2.14.5 allows an authenticated registered user to hijack any non-blocked profile witho
Server-side request forgery in Penpot before 2.15.0 lets an authenticated file editor coerce the backend into fetching a
Missing authorization on Penpot's ::import-binfile RPC command allows any authenticated user to overwrite arbitrary file
Privilege escalation in Penpot before 2.18.0 lets a non-owner team administrator promote themselves to team owner by cre
Missing authorization checks in Penpot prior to 2.18.0 let a holder of a valid share link read design and shape data fro
Server-side request forgery in Penpot before 2.18.0 allows an authenticated user who controls a media-import URL, or an
Penpot versions prior to 2.18.0 leak the contents of other users' in-progress uploads because the backend assemble-chunk
Logout in Penpot versions prior to 2.18.0 clears the browser's auth-token cookie but leaves the matching server-side ses
Authenticated editors on a Penpot file (prior to version 2.18.0) can delete share links that were created by other users
Stored cross-site scripting in Penpot before 2.18.0 allows an authenticated user holding file-edit permission to upload
Authenticated users of Penpot prior to 2.18.0 can exhaust server-side temporary storage by repeatedly re-uploading a val
Exploit-DB