Veille CVE

‹ Retour à la liste

CVE-2026-105694

5.4 Moyenne

Publiée le 05/10/2026 à 22:17 · Modifiée le 08/10/2026 à 05:16 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A victim who navigates to the asset URL executes attacker-controlled JavaScript in that origin, allowing requests and data access with the victim's Penpot session authority. This issue is fixed in version 2.18.0.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 5.4 Moyenne security-advisories@github.com CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Faiblesses (CWE)

Références

Ailleurs