Sandbox Escape Vulnerability in OpenPanel js-runtime by OpenPanel
CVE-2026-93985

9.4CRITICAL

Key Information:

Vendor

Openpanel-dev

Status
Openpanel
Vendor
CVE Published:
19 September 2026

What is CVE-2026-93985?

The OpenPanel js-runtime has a sandbox escape vulnerability within its JavaScript webhook template validator. This issue arises from inadequate restriction on computed member access to constructor chains, allowing attackers with project write access to create malicious webhook templates. By exploiting this flaw, they can gain access to the Function constructor and execute arbitrary code in the worker process, posing significant security risks to systems utilizing this runtime.

Affected Version(s)

openpanel 0

References

https://github.com/Openpanel-dev/openpanel/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/openpanel-js-runtime...
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CaptBoykin
.