CVE-2026-105691

The open-source design platform Penpot contains an OS Command Injection vulnerability in its SVG exporter affecting versions prior to 2.18.0 . The root cause is the unsafely handling of an attacker-controlled fill-color value from a text object, which is placed into a ppmcolormask command string ...