CVE-2026-47665

Penpot , an open-source design and prototyping platform, is affected by a stored cross-site scripting vulnerability in versions up to and including 2.14.3 . Comment content on shared files is stored as raw text and rendered via innerHTML without sanitization; the backend applies only a length che...