Report

Should I Use Penpot?

penpot.app·Analyzed 1 hour ago·Based on 12 sources

Open-source design platform for teams building digital products, spanning design, code, and AI workflows.

Depends

Buy if you want a free or self-hosted design tool and can accept rougher edges than Figma.

Free open-source Figma rival: great for self-hosters and tight budgets, but polish and security lag; Figma teams shouldn't switch.

Confidence: Medium

4.0/5

User rating

SoftwareAdvice

$7/mo

Starting price

paid tier, after free

Yes

Free tier

free open-source core

250K+

Users

as of $12M raise, 2023

Value for money

Free core; paid starts $7/mo

Ease of use

Reviewers say Figma still smoother

Feature depth

Flex, grid, plugins, AI MCP experiments

Security posture

Multiple 2026 CVEs including critical RCE

Pros

Free, open-source core with self-host or on-prem option
Open standards mean flexibility and less vendor lock-in
Used by more than 10,000 companies
Judged a mature Figma alternative by reviewers^⁶
Flex/CSS grid layouts, plugins, and AI MCP experiments¹²

Cons

G2 reviewers say Figma still edges it out
Some users call it a budget Figma clone^⁴
Modest 4.0/5 user rating on SoftwareAdvice^³
Several 2026 CVEs, including a critical RCE¹⁰
Even fans admit they keep re-testing without committing

Gotchas

mediumCommunity openly asks how long the free tier stays free; pricing may shift
mediumFive pricing editions; admin console and governance gated to higher plans^⁷
mediumLeaving Figma means relearning workflows; reviewers cite parity gaps
lowSelf-hosting needs DevOps effort; managed hosting via Elestio costs extra

Best for

Startups dodging per-seat design bills
Teams needing self-hosting or data control
Design-dev duos wanting open standards
Open-source-first orgs

Not for

Teams already fluent in Figma
Anyone wanting Figma-level polish and plugin breadth
Security-sensitive orgs without staff to patch or self-host
Buyers wanting turnkey enterprise support

Pricing

Free

Open-source core
Self-host available

Professional

$7/mo

Paid team features

Enterprise

Not disclosed

Centralized admin console
Deploy in your cloud or on-premises

Security

Active 2026 CVE record — including a critical MCP remote code execution — though the vendor publishes a security whitepaper and supports self-hosting.

CVE-2026-45805: Critical RCE via Penpot MCPRemote code execution vulnerability in Penpot's MCP integration, rated critical.¹⁰
CVE-2026-47666: Stored XSSPenpot vulnerable to stored cross-site scripting.
CVE-2026-26202: Arbitrary file readInformation disclosure flaw, CVSS 7.5.¹¹
CVE-2026-17613: Auth bypassAuthorization bypass vulnerability.