Vulnerability · Published Sep 19, 2026 · Assigned by VulnCheck
CVE-2026-93985OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE
Critical 9.9
In plain English
A critical-severity code injection in openpanel from Openpanel-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.7%top 48.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Openpanel-dev | openpanel | 0 – through 2.3.0 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-6f7h-cvp6-w9w5) vendor-advisory
- VulnCheck Advisory: OpenPanel js-runtime JavaScript Template Sandbox Escape RCE third-party-advisory