CVE-2026-105691 | Penpot up to 2.17.x SVG Exporter child_process.exec fill-color os command injection

October 5, 2026 Yanac

A vulnerability marked as critical has been reported in Penpot up to 2.17.x. This affects the function child_process.exec of the component SVG Exporter. The manipulation of the argument fill-color leads to os command injection.

This vulnerability is referenced as CVE-2026-105691. Remote exploitation of the attack is possible. No exploit is available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More