CVE-2026-45805: PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

May 19, 2026

The MCP module’s ReplServer binds to all interfaces (0.0.0.0:4403) and exposes a /execute endpoint that runs arbitrary code with zero authentication. Anyone on the network can POST JavaScript and it runs on the server. The main PenpotMcpServer was partially fixed for a similar binding issue (#8683), but ReplServer.ts was missed.

References

github.com/advisories/GHSA-22qr-rp27-j9wm
github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm
nvd.nist.gov/vuln/detail/CVE-2026-45805

Code Behaviors & Features

Detect and mitigate CVE-2026-45805 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →