CVE-2026-45805

Publié : 15 juillet 2026

Modifié : 15 juillet 2026

Score CVSS

8.8

HIGH

Description détaillée

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Références et Patchs

https://github.com/penpot/penpot/commit/798ee46b4a84ee6dfc756b001f33acbe0280d62f https://github.com/penpot/penpot/issues/9518 https://github.com/penpot/penpot/releases/tag/2.15.0 https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm

Dernières Vulnérabilités

CVE-2026-62378

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10.

VOIR DÉTAILS

CVE-2026-62287

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61873. Reason: This candidate is a duplicate of CVE-2026-61873. Notes: All CVE users should reference CVE-2026-61873 instead of this candidate.

VOIR DÉTAILS

CVE-2026-62248

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61438. Reason: This candidate is a duplicate of CVE-2026-61438. Notes: All CVE users should reference CVE-2026-61438 instead of this candidate.

VOIR DÉTAILS