CVE-2026-45805
High · 8.8PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
CVSS
8.8
EPSS
0.4%
Published
May 19, 2026
CISA due date
—
The record
The MCP module's `ReplServer` binds to all interfaces (`0.0.0.0:4403`) and exposes a `/execute` endpoint that runs arbitrary code with zero authentication. Anyone on the network can POST JavaScript and it runs on the server. The main `PenpotMcpServer` was partially fixed for a similar binding issue (#8683), but `ReplServer.ts` was missed.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @penpot/mcp | 0 | 2.15.0 |
Related vulnerabilities
- GHSA-22qr-rp27-j9wm PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE Same vulnerability
- CVE-2026-20293 A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation… CWE-749
- CVE-2026-86711 electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron… CWE-749
- CVE-2026-52877 Streambert is a cross-platform Electron Desktop App to stream and download video content. CWE-749
- CVE-2026-48056 Streambert is a cross-platform Electron Desktop App to stream and download video content. CWE-749
- CVE-2026-20467 In apusys, there is a possible escalation of privilege due to a missing bounds check. CWE-749
- CVE-2026-45489 Microsoft Edge (Chromium-based) Spoofing Vulnerability CWE-749
- CVE-2026-14620 webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints… CWE-749