CVE-2026-105691 in Penpot
Summary
by MITRE • 10/06/2026
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec. A user who can edit a file can store shell metacharacters in the fill color and trigger SVG export, causing commands to execute with the exporter service's privileges. The same export can be triggered through a valid public share link to a malicious file. This vulnerability is fixed in 2.18.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Penpot platform, an open-source design and prototyping tool widely used for creating vector graphics and interactive prototypes, was found to contain a critical server-side command injection vulnerability affecting versions prior to 2.18.0. This flaw stems from improper neutralization of special elements used in operating system commands within the SVG export functionality. Specifically, when exporting designs as Scalable Vector Graphics files, the application processes text objects and extracts their fill-color attributes. Instead of sanitizing or escaping these values before use, the software directly embeds them into a command string intended for shell execution via Node.js child_process.exec. This architectural decision creates a direct pathway for attackers to inject arbitrary operating system commands if they can control the content of the SVG export parameters.
The technical root cause lies in the lack of input validation and output encoding when handling user-supplied data that flows into system-level operations. An attacker who has edit access to a Penpot file or possesses a valid public share link to such a maliciously crafted file can embed shell metacharacters, such as semicolons, pipes, or backticks, within the fill-color property of a text object. When the export function is triggered, whether manually by an administrator or automatically through shared access, the application constructs a command line that includes this unsanitized input. The child_process.exec method then passes this entire string to the underlying operating system shell for execution. Because the exporter service typically runs with elevated privileges necessary to write files and manage resources, any injected commands are executed under those same high-privilege contexts.
The operational impact of this vulnerability is severe, allowing for remote code execution on the host server running Penpot. An attacker can leverage this capability to perform a wide range of malicious actions, including reading sensitive configuration files, exfiltrating database credentials stored in environment variables or local config files, installing backdoors, pivoting to other systems within the internal network, or completely compromising the integrity and availability of the design platform. Since public share links allow access without authentication for specific resources, this vulnerability is particularly dangerous as it can be exploited by unauthenticated external actors who discover a link to a maliciously crafted file. The ability to execute commands with exporter service privileges means that even if the web application layer has some security controls in place, the backend process remains fully compromised once the export action occurs.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and is categorized under ATT&CK technique T1059 Command and Scripting Interpreter for lateral movement or persistence if exploited further. To mitigate this risk, organizations must immediately upgrade Penpot to version 2.18.0 or later where the issue has been resolved through proper input sanitization and the use of safer execution methods that do not invoke a shell interpreter with unsanitized arguments. In environments where upgrading is not immediately feasible, administrators should restrict SVG export capabilities to trusted users only, disable public sharing for sensitive projects, and implement strict network segmentation to limit the blast radius in case of exploitation. Additionally, running exporter services under least-privilege accounts can reduce the potential impact of successful command injection attempts by limiting the permissions available to the executed commands.