CRITICAL 9.4 NVD
CVE-2026-93985
OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed m
OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.
References
- https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5
- https://www.vulncheck.com/advisories/openpanel-js-runtime-javascript-template-sandbox-esca
This critical severity vulnerability with a CVSS score of 9.4 was published on 2026-09-19 via NVD.
Risk Timeline
CVE Disclosed2026-09-19 · -1 days ago
Remediation Resources
vulnfeed aggregates 14147 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.