CVE-2026-105691

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0

Description The SVG exporter improperly handles the fill-color value of a text object, inserting it into a ppmcolormask command string that is then executed via child process.exec. An attacker with file editing permissions or one who provides a malicious file via a public share link can inject shell metacharacters into the fill color to execute arbitrary commands with the privileges of the exporter service.

Recommendations Update to version 2.18.0.