Stored cross-site scripting occurs when custom font family names are interpolated into a `@font-face` CSS rule and injected into the page as HTML without sanitization. The backend accepts an arbitrary font-family string, and the frontend writes the resulting style using `innerHTML`. A malicious name containing markup, such as a closing style tag followed by a script, can break out of the style element to execute JavaScript on the Penpot origin. This passive attack triggers script execution when a team member opens a file referencing the malicious font, potentially leading to the theft of session cookies, unauthorized actions performed as the victim, and unauthorized access to files and projects.