{"data":{"id":"d6c5ebfa-10f0-41ad-8e2c-9232fbbcaa31","title":"GHSA-22qr-rp27-j9wm: PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE","summary":"The PenPot MCP module's ReplServer binds to 0.0.0.0:4403 and exposes an unauthenticated /execute endpoint that runs arbitrary JavaScript posted in a JSON code field. The earlier fix for the similar binding issue in #8683 covered PenpotMcpServer.ts but missed ReplServer.ts, which still calls listen(this.port) with no host argument. The reporter demonstrated file reads, command execution and environment variable dumps from another container on the same Docker network.","solution":"Add a host argument to the listen call in ReplServer.ts:89, changing it to this.app.listen(this.port, 'localhost', ...) (the source's own suggested fix), and add authentication to the /execute endpoint, with the source noting even a shared secret from an environment variable would be better than nothing.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-22qr-rp27-j9wm","publishedAt":"2026-05-19T19:57:36.000Z","cveId":"CVE-2026-45805","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@penpot/mcp@< 2.15.0 (fixed: 2.15.0)"],"affectedPackageNames":["@penpot/mcp"],"affectedPackageRefs":["npm:@penpot/mcp"],"affectedVendors":[],"affectedVendorsRaw":["PenPot MCP","Penpot MCP REPL server"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00379,"epssCheckedAt":"2026-11-07T12:08:48.937Z","kevDateAdded":null,"advisoryAliases":["GHSA-22qr-rp27-j9wm"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-19T19:57:36.000Z","fixReleasedAt":"2026-05-12T08:53:12.620Z","daysToFix":-7,"fixCheckedAt":"2026-10-29T21:35:41.554Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@penpot/mcp","fixedVersion":"2.15.0","matchedVersion":"2.15.0","fixReleasedAt":"2026-05-12T08:53:12.620Z","daysToFix":-7,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:35:41.408Z"}]}}