# CVE-2026-45805: Penpot MCP unauthenticated RCE in ReplServer

Source: https://junglewise.ai/threats/cve-2026-45805-penpot-mcp-unauthenticated-rce-in-replserver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-45805 · Severity: high · CVSS 8.8 · Published 2026-07-15

PenPot's MCP (Model Context Protocol) REPL server is a development tool that executes JavaScript code for AI-assisted design workflows. The server listens on all network interfaces without authentication, allowing anyone on the network to remotely execute arbitrary code, read sensitive files, dump credentials, and compromise the entire system.

Technologies: [Penpot Mcp](https://junglewise.ai/threats/technologies/mcp). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Penpot](https://junglewise.ai/threats/vendors/penpot).

## Quick answers

**Is CVE-2026-45805 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45805 being exploited in the wild.

**How severe is CVE-2026-45805?** High severity, with a CVSS score of 8.8, published 15 July 2026.

**Which products and versions are affected?** @penpot/mcp (npm) < 2.15.0, SEMVER:introduced=0,fixed=2.15.0; Penpot Mcp < 2.15.0, all versions before 2.15.0.

**Is there a fix for CVE-2026-45805?** Yes. @penpot/mcp (npm): upgrade to 2.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45805 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-45805?** Check whether you run @penpot/mcp (npm) or Penpot Mcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @penpot/mcp (npm): upgrade to 2.15.0 or later

  ```sh
  npm install @penpot/mcp@2.15.0
  ```


## Technical details

The vulnerability is a combination of two flaws in ReplServer.ts: (1) The Express HTTP server is bound to all interfaces (0.0.0.0:4403) due to a missing hostname argument in the listen() call—Express defaults to 0.0.0.0 when no host is specified; (2) the POST /execute endpoint accepts arbitrary JavaScript code in the request body with zero authentication checks and executes it via PluginBridge.executePluginTask(). An attacker needs only network access to the port and can invoke the endpoint with a POST request containing JSON with a "code" field. This enables full code execution as the server process, allowing file system access, command execution, and environment variable exfiltration (often containing database credentials and API keys). The vulnerability affects all versions prior to 2.15.0; a prior partial fix (#8683, #8686) only addressed the main PenpotMcpServer but overlooked ReplServer.ts.

## Affected products

- PenPot @penpot/mcp all versions before 2.15.0

## Identifiers

- CVE-2026-45805
- GHSA-22qr-rp27-j9wm

## Timeline

- 2026-05-19: disclosed: Vulnerability disclosed via GitHub security advisory GHSA-22qr-rp27-j9wm
- 2026-05-19: patched: Fixed in version 2.15.0

## References

- [https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm](https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm)
- [https://github.com/penpot/penpot](https://github.com/penpot/penpot)