Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend applies only a length check and the frontend writes comment content directly through innerHTML, any team member who can comment on a shared file can embed HTML such as an image error handler or script that executes in the browser of every other collaborator. The attack is passive: any user who opens the comments panel on the affected file triggers script execution on the Penpot origin, allowing theft of session cookies, actions performed as the victim, and access to their files and projects. This issue is fixed in version 2.15.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-27 | 2 | General1Patch1 |
| 2026-09-02 | 1 | Patch1 |
🚨 HIGH: CVE-2026-47665 (CVSS 8.7) - Stored XSS in Penpot design platform ≤2.14.3. Malicious comments execute scripts, steal sessions & access files. Patch to v2.15.3 immediately. #CVE #Vulnerability #PatchNow https://t.co/YLwiR8LN1W
Post summary
The tweet alerts users to a high‑severity stored XSS flaw in Penpot and urges upgrading to v2.15.3 as a fix.
CVE-2026-47665 - Stored XSS in Penpot design platform via file comments. CVSS 8.7. Restrict comment access and monitor for patches. #CVE #Penpot #cybersecurity https://www.valtersit.com/cve/CVE-2026-47665/ #CVE #CVEAlert #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #china #france #germany #docker
Post summary
The tweet highlights a stored XSS vulnerability (CVE‑2026‑47665) affecting Penpot file comments, CVSS 8.7, and recommends restricting comment access while awaiting vendor patches.
CVE-2026-47665 Stored XSS in Penpot via File Comments Allows Session Cookie Theft https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47665
Post summary
The post references CVE‑2026‑47665, a stored XSS flaw in Penpot that can steal session cookies via file comments, but provides no PoC, exploit code, or patch information.