Remote Code Execution in OpenPanel by OpenPanel Development Team

CVE-2026-85610

What is CVE-2026-85610?

OpenPanel versions prior to 2.3.0 have a significant vulnerability that allows authenticated project members with read access to exploit improperly validated chart formula expressions. By leveraging mathjs matrix objects, attackers can recover the native JavaScript Function constructor, gaining the ability to load Node.js built-ins and execute arbitrary operating system commands. This exploitation enables them to bypass organizational authorization boundaries, posing serious security risks for affected users.

References