CVE-2026-47666

Executive Summary

CVE-2026-47666 is a stored cross-site scripting (XSS) vulnerability affecting Penpot, an open-source design and prototyping platform, in all versions up to and including 2.14.3. The flaw resides in how custom font family names are processed and rendered: malicious input is interpolated into a @font-face CSS rule and injected into the page without sanitization, allowing an attacker to break out of the style element and execute arbitrary JavaScript on the Penpot origin. Successful exploitation is passive for the victim — merely opening a file that references the malicious font triggers script execution, enabling session cookie theft, unauthorized actions on behalf of the victim, and access to their files and projects. The issue is addressed in version 2.15.3.

Technical Analysis

The vulnerability is fundamentally a stored cross-site scripting (XSS) issue arising from improper handling of user-controllable font family names within Penpot's rendering pipeline. The platform adopts a design where users can define custom fonts for use across files and projects. The backend accepts an arbitrary font-family string without sufficiently restricting its format or length.

The core mechanism is as follows:

1. A user with the ability to create or modify font definitions supplies a custom font family name. The backend does not validate or sanitize this string against markup or script content — it accepts the arbitrary string and persists it as part of the font configuration.

2. When the frontend renders a page that references this font, the application constructs an HTML string containing a @font-face CSS rule. The attacker-controlled font-family name is interpolated directly into this rule.

3. The resulting string is then written into the page's DOM through the innerHTML property, which causes the browser to parse the entire string as HTML. The attacker can craft the font-family name to include markup such as a closing </style> tag followed by a <script> element. Because the string is parsed as HTML (not just CSS), the closing style tag terminates the <style> element prematurely, and the embedded <script> tag becomes an active, executable element in the DOM.

This is a classic "CSS injection via style block breakout" pattern, where the sanitization failure occurs at two layers: the backend fails to reject or escape attacker-controlled strings embedded in CSS context, and the frontend fails to use safe DOM manipulation APIs (such as textContent or CSSOM-style property assignment) and instead uses innerHTML.

The attack is classified as passive because the victim is not tricked into interacting with the payload. Simply rendering the page — opening a shared design file that references the malicious font definition — causes the injected script to run. The script executes with the origin and privileges of the Penpot application, meaning it can read cookies, perform API requests as the authenticated victim, and access resources the victim can access.

Exploitation Scenarios

Reconnaissance / Target Identification: An attacker first identifies a Penpot instance (via SHODAN, search engines, or organizational interception/discovery). The attacker then authenticates to the platform — CVSS vector indicates PR:L (Low privilege required), meaning the attacker needs only a valid account with basic file-creation or font-definition privileges, not an administrator account.

Triggering the Flaw: With an authenticated session, the attacker creates a custom font definition, supplying a font-family name crafted to close the surrounding HTML context and inject a script element. A plausible payload pattern (based on the vulnerability class) would be something like:

</style><script>/* malicious JavaScript here */</script>

The exact payload is not provided in the description, but it must break out of the <style> element and inject an executable tag.

Delivery / Execution Method: The attacker saves the malicious font definition and then references it in a design file (or shares a file that references it). Any team member who opens the file causes the frontend to construct the @font-face CSS rule containing the malicious font name and inject it into the DOM via innerHTML. The injected <script> executes in the victim's browser within the Penpot origin.

Post-Exploitation Impact: The injected script can (at minimum):

• Steal session cookies and send them to an attacker-controlled endpoint.
• Perform actions as the victim — e.g., deleting files, exfiltrating project data, creating malicious content.
• Access the victim's files and projects, which may contain proprietary design assets, credentials embedded in documents, or sensitive intellectual property.

Because the attack is passive (triggers on render, not on click), it requires no social engineering beyond convincing a team member to open a shared design file — a normal, everyday action in a design collaboration platform.

Impact Assessment

CVSS Breakdown Context: The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N yields a base score of 7.6 (High). Key factors:

• Attack Vector: Network — remotely exploitable over the network.
• Attack Complexity: Low — no special conditions or race windows required.
• Privileges Required: Low — an attacker needs a low-privilege account, not admin.
• User Interaction: Required — the victim must open the malicious file (passive, but still interaction).
• Scope: Changed — the injected malicious script affects resources beyond the attacker's authorized scope, impacting the victim's session and data.
• Confidentiality: High — script can read session tokens and potentially all victim data accessible through the application.
• Integrity: Low — script can modify some content, but in the design context, primarily inflicts limited integrity impact.
• Availability: None — no direct availability impact.

Business Impact:

• Data Exposure: Design files in Penpot frequently contain proprietary product mockups, brand assets, architecture diagrams, and credentials (e.g., API keys pasted into text layers). Theft of these assets can result in intellectual property loss and competitive damage.
• Account Takeover: Stolen session cookies enable full account takeover of the victim, allowing the attacker to impersonate designers, admins, or contractors with access to multiple projects.
• Lateral Movement Within the Platform: A compromised session may allow access to shared workspaces and projects, extending the blast radius beyond the initially compromised account.
• Multi-Tenant Instances: For SaaS deployments of Penpot hosting multiple organizations, a single malicious font could compromise files of any team that happens to open the crafted file.

Blast Radius: Any user who opens a file referencing the malicious font family. In an enterprise deployment, this could affect designers, project managers, developers reviewing design specs, and external collaborators. The scope change (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component to the entire application session.

Detection Guidance

Sigma Rule

title: Penpot Stored XSS via Malicious Font Family Name
id: 3f887c8e-68d1-4a56-9f45-02d0dd9cb521
status: experimental
description: Detects HTTP requests to Penpot API creating or updating font definitions containing script-like markup in the font-family parameter.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-47666
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
    category: webserver
    product: nginx
    definition: Web server logs from Penpot reverse proxy
detection:
    selection:
        http.method:
            - POST
            - PUT
            - PATCH
        http.url|contains:
            - '/api/'
            - '/fonts'
        http.request_body|contains|all:
            - 'font-family'
            - '</style>'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate scientific or typographical test cases with HTML-like content
level: high

YARA Rule

rule Penpot_Stored_XSS_Font_Family {
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-02-15"
        description = "Detects payload patterns in HTTP traffic or logs associated with CVE-2026-47666 stored XSS via font family names"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-47666"
        score = 80
    strings:
        $s1 = "font-family" ascii nocase
        $s2 = "</style>" ascii nocase
        $s3 = "<script" ascii nocase
        $s4 = "@font-face" ascii nocase
        $s5 = "innerHTML" ascii nocase
    condition:
        all of ($s1, $s2, $s3) or (all of ($s1, $s4) and any of ($s2, $s3, $s5))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-47666 Penpot Stored XSS via Font Family"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/"; http.uri; content:"font"; nocase; http.request_body; content:"</style>"; content:"<script"; http.request_body; distance:0; sid:66847666; rev:1; classtype:web-application-attack; reference:cve,2026-47666;)

Note: Adjust $HOME_NET to the Penpot server IP range. The rule matches on POST requests to Penpot API paths containing font-related endpoints, with payload markers </style> and <script in the request body, consistent with the vulnerability's attack vector.

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where event.action == "connection_attempted" and destination.port == 443 ]
  [ http where event.category == "web" and http.request.method == "POST" and
    url.path like* "/api/*" and
    http.request.body.content contains "</style>" and
    http.request.body.content contains "<script" ]

Splunk SPL Query

index=web sourcetype=access_combined
  method=POST
  uri_path="/api/*"
  body="*</style>*"
  body="*<script*"
| stats count by src_ip, uri_path, status, _time
| table _time, src_ip, uri_path, status, count

For proxy-level detection (if request body is logged):

index=proxy sourcetype=stream:http
  http_method=POST
  url="*/api/*font*"
  request_body="*</style>*<script*"
| eval alert=if(match(request_body, ".*</style>.*<script.*"), "CVE-2026-47666 Potential Exploitation", "monitor")
| where alert="CVE-2026-47666 Potential Exploitation"
| table _time, src_ip, dest_host, url, request_body

Wazuh OSSEC Rule

<group name="penpot,">
  <rule id="668476" level="15">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <match>api/|font</match>
    <regex>.*</style>.*<script.*</regex>
    <description>CVE-2026-47666 Penpot Stored XSS via malicious font-family name detected in HTTP request body.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attacker_technique,web_application_attack,xss,</group>
  </rule>
</group>

If using Apache/Nginx JSON logs, adjust <field name> to match actual field names in logs (e.g., request for full HTTP request line).

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — No patch evidence from any tracked source. The official fix is delivered in Penpot version 2.15.3. No vendor advisory, source commit, or CVE patch reference was available at the time of this report's compilation; the fix is inferred from the NVD description's statement that "This issue is fixed in version 2.15.3."

1) Immediate Mitigations (until 2.15.3 is deployed)

• Restrict account creation: Only allow invited team members to register; do not permit open self-registration on the Penpot instance.
• Restrict font definition privileges: If the platform supports role-based permissions, limit who can create or upload custom font families. The vulnerability requires the ability to define custom fonts — reduce the set of users with this permission.
• Network-level blocking: Deploy a WAF (e.g., ModSecurity) rule to inspect POST/PUT requests to API endpoints that handle font definitions, blocking any body containing </style> or <script in combination with the strings font-family or @font-face. The Suricata/Elastic/Splunk rules above can also be deployed to alert on attempts.
• Audit existing font definitions: Manually inspect all existing font definitions in the platform for any string containing HTML markup or script-like patterns. Remove any suspicious entries.
• Session hardening: If cookies support the HttpOnly and Secure flags, ensure they are set — this mitigates session-stealing via injected JavaScript (though it does not prevent actions performed as the victim).

2) Patch / Upgrade Steps

• Upgrade to Penpot ≥ 2.15.3 as soon as the release becomes available from the project's official distribution channels (GitHub releases or package repositories). Follow the project's upgrade documentation for database migrations and service restart procedures. No CVE patch commit or vendor advisory link is available; refer to the official Penpot changelog for release notes.
• Verify the instance after upgrade: confirm font-family strings are properly sanitized (escaped or rejected when containing markup) in both frontend rendering and backend validation.

3) Long-Term Hardening

• Input validation: The backend should enforce a whitelist for font family names — restrict to alphanumeric characters, spaces, hyphens, and standard typographic characters; reject anything containing <, >, /, quotes, or backticks.
• Safe DOM API usage: The frontend should not use innerHTML for writing style-related content. Use textContent followed by CSSOM property assignment for @font-face rules, or construct CSS using CSSStyleSheet.insertRule() which does not parse HTML.
• Content Security Policy (CSP): Deploy a strict CSP that disallows inline scripts (script-src 'self' with nonces/hashes). This provides defense-in-depth even if XSS payloads are injected.
• Cookie security: Ensure HttpOnly and Secure flags on session cookies to reduce impact of XSS-driven cookie theft.
• Security review of rendering pipeline: Audit all innerHTML usages in the frontend codebase — any user-controlled data reaching innerHTML is a code-smell warranting refactoring.
• Threat monitoring: Deploy the detection rules above and train SOC analysts on the attack pattern (CSS breakout via style tags).

References

1. NVD Entry – CVE-2026-47666: https://nvd.nist.gov/vuln/detail/CVE-2026-47666
2. Penpot Project Website / Changelog (for 2.15.3 release notes): https://penpot.app/ (official site) and https://github.com/penpot/penpot (GitHub releases)
3. MITRE ATT&CK Technique – T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. OWASP Cross-Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
5. FIRST CVSS Calculator (for vector reference): https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Threat actor campaigns: No known threat actor campaigns or exploit-in-the-wild evidence reported at the time of compilation. CISA KEV: NO — not listed on CISA's Known Exploited Vulnerabilities catalog. PoC / exploit code status: None publicly available.