GHSA-22qr-rp27-j9wm: PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

Summary

The PenPot MCP module's ReplServer binds to 0.0.0.0:4403 and exposes an unauthenticated /execute endpoint that runs arbitrary JavaScript posted in a JSON code field. The earlier fix for the similar binding issue in #8683 covered PenpotMcpServer.ts but missed ReplServer.ts, which still calls listen(this.port) with no host argument. The reporter demonstrated file reads, command execution and environment variable dumps from another container on the same Docker network.

Mitigation

Add a host argument to the listen call in ReplServer.ts:89, changing it to this.app.listen(this.port, 'localhost', ...) (the source's own suggested fix), and add authentication to the /execute endpoint, with the source noting even a shared secret from an environment variable would be better than nothing.

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
• MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
• CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database