CVE-2026-47666

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.15.3

Description Stored cross-site scripting occurs when custom font family names are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. The backend accepts an arbitrary font-family string, and the frontend writes the resulting style using innerHTML. A malicious name containing markup, such as a closing style tag followed by a script, can break out of the style element to execute JavaScript on the Penpot origin. This passive attack triggers script execution when a team member opens a file referencing the malicious font, potentially leading to the theft of session cookies, unauthorized actions performed as the victim, and unauthorized access to files and projects.

Recommendations Update to version 2.15.3.