A stored cross-site scripting vulnerability in Penpot allows authenticated users to execute malicious scripts in the browsers of other collaborators, posing a critical risk to session and data integrity.

This is a stored cross-site scripting (CWE-79) vulnerability occurring because the application renders file comment content using innerHTML without prior sanitization. An authenticated user with permission to comment on a file can inject malicious HTML or JavaScript that executes whenever a victim views the comments panel.

The exploitation of this vulnerability allows an attacker to perform unauthorized actions on behalf of other users, including project administrators. Successful execution can lead to the theft of session cookies, unauthorized access to sensitive design projects, and potential account takeover. With a CVSS score of 8.7, this high-severity flaw represents a significant risk to the confidentiality and integrity of proprietary design data.

Immediate Action: Update the Penpot installation to version 2.15.3 or later immediately to apply the required sanitization fixes.

Proactive Monitoring: Review web access logs for unusual patterns in comment submissions or suspicious script-like payloads originating from authenticated user accounts.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts, and utilize a Web Application Firewall (WAF) to detect and block common XSS patterns in HTTP requests.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS severity and the ease with which an authenticated attacker can compromise other users, organizations should prioritize the update to version 2.15.3. All Penpot instances should be patched as part of the next maintenance cycle, and administrators should ensure that users are aware of the risk of interacting with untrusted file comments until the patch is applied.