Description

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A victim who navigates to the asset URL executes attacker-controlled JavaScript in that origin, allowing requests and data access with the victim's Penpot session authority. This issue is fixed in version 2.18.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-10-05T20:17:19.813Z",
  "pubdate": "2026-10-05T20:17:19.813Z",
  "executiveSummary": "A critical stored Cross-Site Scripting (XSS) vulnerability exists in Penpot prior to version 2.18.0. The vulnerability resides in the media upload functionality, where SVG files containing malicious scripts, event-handler attributes, or foreignObject elements are processed and stored without adequate sanitization.\nBecause these assets are served directly from the Penpot origin with the image/svg+xml MIME type, the browser executes the embedded JavaScript within the context of the Penpot session when an authenticated user navigates to the asset URL.\nThis vulnerability allows an attacker with 'file-edit' permissions to gain unauthorized access to the session authority of other users, including potentially high-privileged accounts. The impact involves potential account takeover, unauthorized access to design projects, and the exfiltration of sensitive platform data. Exploitation is facilitated by the browser's execution of scripts within the same origin as the application, effectively bypassing typical domain-based security controls. Users are strongly advised to upgrade to version 2.18.0 to neutralize this vector.",
  "technicalDetails": "The root cause of this vulnerability is an improper input validation and sanitization mechanism within the Penpot SVG file handling pipeline. When a user with file-edit privileges uploads an SVG file, the application fails to strip or neutralize active content—specifically <script> elements, intrinsic event handler attributes (e.g., onload, onerror), and <foreignObject> elements that can be leveraged to inject arbitrary markup or script execution.\nThe application stores these unsanitized SVG payloads and serves them back to users with the Content-Type header set to 'image/svg+xml'. By serving the content from the primary Penpot domain, the browser treats the SVG as an active resource within the application's origin rather than an untrusted user-uploaded asset. Consequently, the browser's Same-Origin Policy (SOP) considers the script execution to be legitimate within the Penpot context.\nThe attack flow follows a structured sequence: 1) The attacker crafts an SVG payload containing malicious JavaScript. 2) The attacker uploads the file to a Penpot project where they possess file-edit permissions. 3) The attacker shares the direct asset URL with a victim or lures them to access the file. 4) Upon navigation, the victim's browser parses the SVG and executes the attacker's JavaScript within the victim's authenticated session.\nBecause the payload executes under the victim's session authority, the attacker can perform unauthorized API requests, manipulate session cookies if not protected by HttpOnly flags (or leverage session-based authentication tokens), and interact with the Penpot API to modify, delete, or exfiltrate sensitive design data. The attack is particularly effective as it relies on the user simply interacting with a link to a resource they believe is safe within the platform.\nThe vulnerability affects all versions of Penpot prior to 2.18.0. It requires an attacker to possess valid credentials and sufficient permissions to upload assets, making this an authenticated XSS attack. The exposure is wide-reaching, as any user or administrator who views the malicious SVG file is susceptible to the scripted payload execution, leading to a compromise of their active session and subsequent potential for cross-site request forgery (CSRF) or unauthorized data access."
}