CVE-2026-47666

Penpot (open-source design and prototyping platform) versions up to and including 2.14.3 are affected by a stored XSS via custom font family names. Arbitrary font-family strings are interpolated into a @font-face CSS rule and injected via innerHTML without sanitization, allowing an attacker to br...