The vulnerability exists in Penpot, an open‑source design and code collaboration platform. Prior to version 2.15.0, the MCP REPL server bound to 0.0.0.0 on port 4403 and exposed an unauthenticated "/execute" endpoint that forwarded the code field to PluginBridge.executePluginTask(). This allowed any host on the network to execute JavaScript on the server, giving full control over the server's runtime environment and compromising confidentiality, integrity, and availability. The issue is resolved in version 2.15.0 by removing the unauthenticated endpoint and changing the binding address to an internal interface.

The affected product is Penpot, the open‑source design platform. Versions prior to the 2.15.0 release are vulnerable; all releases from 2.15.0 onward contain a fix that removes the unauthenticated endpoint and changes the binding to an internal address.

The CVSS score of 8.8 indicates a high‑severity flaw, and the EPSS score of less than 1% shows it is not widely exploited in the wild. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a direct network connection to port 4403; an attacker does not need authentication and can send a crafted HTTP request to perform remote code execution. Given the high impact and vulnerable service running on the network, the risk is significant for any environment that exposes the service to untrusted hosts.