CVE-2026-105691

Executive Summary

CVE-2026-105691 is a command injection vulnerability in Penpot, an open-source design and prototyping platform, affecting versions prior to 2.18.0. The SVG exporter places an attacker-controlled fill-color value from a text object directly into a ppmcolormask command string that is executed via child_process.exec, allowing an actor who can edit a file — or trigger a public share link to a malicious file — to achieve shell command execution with the privileges of the exporter service. With a CVSS base score of 9.9 (Critical), a scope change, and high confidentiality/integrity/availability impact, this vulnerability represents a severe risk to any organization hosting a Penpot instance accessible to untrusted users.

Technical Analysis

The vulnerability resides in Penpot's SVG export pipeline. According to the NVD description, the SVG exporter constructs a ppmcolormask command string that incorporates an attacker-controlled text object's fill-color value. This string is then passed to child_process.exec.

The core defect is CWE-78 (Improper Neutralization of Special Elements used in an OS Command, commonly referred to as OS Command Injection). Because child_process.exec invokes a shell rather than executing a binary directly, any shell metacharacters embedded in the fill-color value are interpreted by the shell. An attacker who can store shell metacharacters in the fill color of a text object can achieve arbitrary command execution when the SVG export is subsequently triggered.

The attack surface spans two distinct vectors:

1. A user with edit privileges on a Penpot file can set a malicious fill color and then trigger an SVG export.
2. A public share link to a malicious file can be used to trigger the export without requiring an authenticated editing session on the victim side.

The NVD description does not specify the literal ppmcolormask invocation arguments, the exact metacharacter sanitization gaps, or the precise text-object property path. No public Proof-of-Concept (PoC), exploit code, or Nuclei template is available, and the vulnerability has not been added to CISA KEV. The attack chain below is therefore inferred at the vulnerability-class level.

CVSS subscores:

• AV:N — exploitable remotely over the network.
• AC:L — no special attack complexity.
• PR:L — requires low privileges (edit access or a valid share link).
• UI:N — no user interaction required beyond triggering the export.
• S:C — a scope change occurs: the vulnerable exporter component impacts resources beyond its security scope (the host operating system).
• C:H/I:H/A:H — high confidentiality, integrity, and availability impact, consistent with arbitrary OS command execution.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (OS command injection via child_process.exec with attacker-controlled input).

1. Reconnaissance / Target Identification. An attacker identifies a network-accessible Penpot instance running a version prior to 2.18.0. Public share links (where enabled) represent an unauthenticated ingress path into the export pipeline.

2. Triggering the Flaw. The attacker gains the ability to edit a Penpot file — either through a legitimate low-privileged account or by distributing a malicious file via a public share link. Within a text object, the attacker stores shell metacharacters in the fill-color value. When the SVG export is invoked, the exporter interpolates this attacker-controlled value into the ppmcolormask command string and executes it through child_process.exec.

3. Payload / Execution Method. Because child_process.exec runs the assembled string via a shell, shell metacharacters break out of the intended command context and allow additional commands to be appended. The specific injected command string is attacker-defined; the NVD description does not constrain or enumerate the payload. Execution occurs with the privileges of the exporter service.

4. Post-Exploitation Impact. Successful exploitation grants command execution as the exporter service. From there, an attacker may read or exfiltrate data accessible to the service, modify files and application state (high integrity impact), and disrupt service availability (high availability impact). The scope change (S:C) indicates the compromise can extend beyond the vulnerable component to the underlying host.

Impact Assessment

This is a Critical (9.9) remote command injection. Any organization running a Penpot instance below 2.18.0 that is reachable by untrusted users — or that enables public share links — is exposed. The PR:L rating reflects that an attacker needs at least edit rights on a file or a valid public share link; the UI:N rating indicates no additional victim interaction beyond triggering the export.

Business impact includes:

• Confidentiality (C:H): Potential exfiltration of design assets, user data, configuration, and secrets accessible to the exporter service.
• Integrity (I:H): Ability to alter files and application state on the host.
• Availability (A:H): Ability to disrupt or destroy service availability.
• Scope (S:C): Impact extends beyond the exporter component to the host operating system, widening the blast radius.

Because Penpot is frequently self-hosted in enterprise environments, a compromised exporter service can serve as a foothold for lateral movement into internal networks. Multi-tenant or shared Penpot deployments increase the blast radius substantially.

Detection Guidance

Sigma Rule

title: Penpot SVG Export Command Injection Attempt (CVE-2026-105691)
id: 8f2c1a44-7d3e-4b9a-9c21-5e6f0a1b2c3d
status: experimental
description: Detects shell metacharacters in fill-color values associated with Penpot SVG export abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105691
author: valtersit.com
date: 2026-01-01
logsource:
  product: linux
  service: auditd
detection:
  selection_exec:
    type: EXECVE
    a0|contains: 'ppmcolormask'
  selection_meta:
    a1|contains:
      - ';'
      - '&&'
      - '||'
      - '`'
      - '$('
  condition: selection_exec and selection_meta
falsepositives:
  - Legitimate color values containing unusual characters (unlikely)
level: critical

YARA Rule

rule CVE_2026_105691_Penpot_SVG_Command_Injection
{
    meta:
        description = "Detects Penpot SVG export command injection indicators (CVE-2026-105691)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105691"
        date = "2026-01-01"
    strings:
        $ppm = "ppmcolormask" ascii nocase
        $meta1 = ";" ascii
        $meta2 = "&&" ascii
        $meta3 = "$(" ascii
        $metab = "`" ascii
        $penpot = "penpot" ascii nocase
    condition:
        $ppm and $penpot and 1 of ($meta*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105691 Penpot SVG Export Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"export"; nocase; http.request_body; content:"fill"; nocase; http.request_body; pcre:"/(;|&&|\|\||`|\$\(|\|\s*\w+)/"; reference:cve,2026-105691; classtype:web-application-attack; sid:2026105691; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name : ("node", "npm") and
  process.command_line : "*ppmcolormask*" and
  process.command_line : ("*;*", "*&&*", "*$(*", "*`*")

Splunk SPL Query

index=edr OR index=linux_processes sourcetype=process_events
| search process_name="sh" OR process_name="bash" OR parent_process="node"
| where match(command_line, "ppmcolormask") AND match(command_line, "(;|&&|\|\||\$\(|`)")
| table _time, host, user, parent_process, process_name, command_line
| sort - _time

Wazuh OSSEC Rule

<group name="penpot,cve-2026-105691,">
  <rule id="105691" level="15">
    <if_sid>100000</if_sid>
    <field name="command">ppmcolormask</field>
    <regex type="pcre2">(;|&&|\|\||`|\$\().*</regex>
    <description>CVE-2026-105691: Possible Penpot SVG exporter command injection detected</description>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in 2.18.0, but no vendor advisory, commit, or release artifact has been corroborated by tracked sources (Patch Sources: []).

1. Immediate mitigations

   • Upgrade Penpot to 2.18.0 as stated in the NVD description; until the update is validated by the vendor's release notes, treat filtering below as compensating controls.
   • Disable or restrict public share links for files hosted on untrusted instances.
   • Restrict editing permissions to trusted users and separate the SVG export worker from sensitive network segments.
   • Run the exporter service with the least privilege possible (container isolation, read-only mounts, restricted egress).

2. Patch/upgrade steps

   • Verify the Penpot release notes and changelog for 2.18.0 to confirm the fix before and after deployment.
   • Stage the upgrade in a non-production environment and validate that SVG export functions correctly.
   • Because no patch hash or commit is available, corroborate the applied version against the official vendor distribution channel.

3. Long-term hardening

   • Replace shell execution (child_process.exec) with non-shell execution (execFile/spawn with argument arrays) in any custom fork.
   • Implement strict validation and sanitization of all interpolated values passed into external commands.
   • Apply egress filtering and runtime monitoring to the exporter service.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-105691
• CWE-78: Improper Neutralization of Special Elements used in an OS Command — https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1059 — Command and Scripting Interpreter — https://attack.mitre.org/techniques/T1059/
• Penpot official project repository and release notes (verify 2.18.0 release notes directly)
• CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (no CVE-2026-105691 entry; not listed)

No public PoC, exploit code, or Nuclei template was identified. The vulnerability has not been added to CISA KEV, and no exploit-in-the-wild activity or named threat actor campaigns are currently attributed to this CVE in the provided data.