Kairos-T

**Name of the Vulnerable Software and Affected Versions** Penpot versions prior to 2.18.0 **Description** Authenticated users with file-edit permissions can upload SVG media containing scripts, event-handler attributes, and `foreignObject` elements that are stored without sanitization and served as `image/svg+xml` from the Penpot origin. A victim navigating to the asset URL may execute attacker-controlled JavaScript within that origin, enabling requests and data access using the victim's session authority. **Recommendations** Update to version 2.18.0.