CVE-2026-47665

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.15.3

Description Stored cross-site scripting occurs when file comments are stored as raw text and rendered into the page using innerHTML without sanitization. The backend only performs a length check, allowing a team member to embed HTML or scripts within a comment. When other collaborators open the comments panel, the script executes on the Penpot origin, which can lead to the theft of session cookies, unauthorized actions performed as the victim, and unauthorized access to files and projects.

Recommendations Update to version 2.15.3.