Improper Escaping Vulnerability in OpenPanel by OpenPanel Dev

CVE-2026-116815

What is CVE-2026-116815?

The earlier versions of OpenPanel, specifically before 3.0.0, include an improper escaping vulnerability found in sankey.service.ts. This flaw permits authenticated project members to disrupt ClickHouse string literals by inputting backslashes into event names. Consequently, attackers with read access may exploit this by sending specially crafted 'events[].name' parameters to the chart.sankey procedure. This can lead to parse errors in ClickHouse, resulting in the failure of the project's Sankey chart endpoint, thereby impacting data presentation and functionality.

References