Penpot MCP ReplServer Unauthenticated Remote Code Execution
First seen Jul 15, 2026 · Updated Jul 15, 2026 · CVSS 8.8
Penpot's MCP server component exposed an unauthenticated HTTP endpoint bound to all network interfaces that allowed arbitrary JavaScript execution on the host. Any network-adjacent attacker could remotely execute code without credentials, making this a critical, easily exploitable vulnerability in an agent-tooling component.
Technical Analysis
The Penpot MCP ReplServer (mcp/packages/server/src/ReplServer.ts) bound its listener to 0.0.0.0:4403, exposing the service beyond localhost to any host on the network. The /execute endpoint accepted a 'code' field and passed it directly to PluginBridge.executePluginTask() without authentication or input validation, enabling arbitrary JavaScript execution in the server's plugin execution context. This is a classic tool-layer vulnerability in an MCP server implementation: the tool endpoint itself acts as an unrestricted code execution primitive, giving an attacker full compromise of the MCP server process and potentially lateral access to whatever the Penpot backend or connected agents can reach. Because MCP servers are often invoked by AI agents with elevated trust, an attacker exploiting this endpoint could pivot to poisoning agent tool responses or hijacking downstream agent behavior.
Affected Systems
Penpot MCP server; protocols: MCP
Detection Signatures
- HTTP POST requests to /execute endpoint on port 4403 from unexpected source IPs
- Outbound connections to 0.0.0.0:4403 or non-localhost binding of ReplServer
- Unexpected PluginBridge.executePluginTask() invocations in server logs
- Unauthenticated requests containing arbitrary 'code' payloads in request body
Remediation Steps
- 1
Upgrade Penpot
Update to Penpot 2.15.0 or later, which fixes the ReplServer binding and adds authentication to the /execute endpoint.
- 2
Restrict network exposure
Ensure MCP server components bind only to localhost (127.0.0.1) unless external access is explicitly required and authenticated.
- 3
Add authentication to tool endpoints
Require API keys, mTLS, or session tokens on all MCP server execution endpoints to prevent unauthenticated code execution.
- 4
Network segmentation
Place MCP servers behind firewalls or VPNs that restrict access to trusted agent orchestrators only.
- 5
Audit logging
Enable logging of all /execute calls including source IP, payload, and execution result for forensic review.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.