A critical (CVSS 9.9) sandbox escape in OpenPanel's js-runtime lets any user with project write access break out of the JavaScript webhook template validator and execute arbitrary code in the worker process.
What Is It
OpenPanel's js-runtime includes a validator meant to constrain the JavaScript used in webhook templates. Through commit bad75bdd, that validator fails to block computed member access to constructor chains. An attacker who can author a webhook template can use computed property notation to reach the Function constructor and execute arbitrary code inside the worker process; a classic code injection escape, tracked as CWE-94.
The prerequisite is project write access, not anonymous access. The attack is remote, low-complexity, requires no user interaction, and needs only low privileges.
Why It Matters
The CVSS 3.1 base score is 9.9 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The CVSS 4.0 secondary score is 9.4 (CRITICAL). Two details drive the severity:
- Scope is Changed. Code escaping the sandbox runs in the worker process, outside the security boundary the validator was supposed to enforce. Subsequent-system confidentiality, integrity, and availability impacts are all rated HIGH under CVSS 4.0.
- Low bar to reach. Any account with project write permissions, an ordinary collaborator, a compromised low-value credential, or a rogue tenant in a shared deployment, is enough. Based on the advisory data available, the sandbox appears to be the primary control standing between template authorship and code execution.
What's Vulnerable
- Vendor: Openpanel-dev
- Product: openpanel (js-runtime component, JavaScript webhook template validator)
- Affected versions: all commits from
0through and includingbad75bddc74d12d36cfb843f4531d3b830a8d994. Versioning is tracked by git commit rather than release tag; default status for other commits is unaffected.
No CPE entries have been published for this CVE, so automated inventory matching is unlikely to flag affected deployments; identify exposure by checking the commit your instance is built from.
Patch Status
The NVD record was published 2026-09-19 with vulnStatus: Received and no CISA KEV entry, so there is no confirmation of active exploitation and no federally mandated remediation deadline at this time. No fixed version or patch identifier appears in the supplied data; the vendor's GitHub security advisory (GHSA-6f7h-cvp6-w9w5) is the authoritative place to check for fix availability and any workaround guidance.
Sources
- NVD, CVE-2026-93985: https://nvd.nist.gov/vuln/detail/CVE-2026-93985
- GitHub Security Advisory; GHSA-6f7h-cvp6-w9w5: https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5
- VulnCheck Advisory; OpenPanel js-runtime JavaScript Template Sandbox Escape RCE: https://www.vulncheck.com/advisories/openpanel-js-runtime-javascript-template-sandbox-escape-rce