Description
The MCP module’s ReplServer binds to all interfaces (0.0.0.0:4403) and exposes a /execute endpoint that runs arbitrary code with zero authentication. Anyone on the network can POST JavaScript and it runs on the server. The main PenpotMcpServer was partially fixed for a similar binding issue (#8683), but ReplServer.ts was missed.
Recommendation
Update the @penpot/mcp package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.15.0
- Patched version(s): 2.15.0
References
Could your website be exposed too?
SmartScanner can check your website for PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) - CVE-2026-69263
- @andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default - CVE-2026-54504
- MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint - CVE-2026-42281
- Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor - CVE-2026-43943
You might also like:
See something that needs correcting? Let us knowUpdated May 19, 2026