{"id":"CVE-2026-93985","published":"2026-09-19T12:16:41.873","lastModified":"2026-09-22T20:43:58.793","description":"OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5","tags":[]},{"url":"https://www.vulncheck.com/advisories/openpanel-js-runtime-javascript-template-sandbox-escape-rce","tags":[]},{"url":"https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5","tags":[]}],"exploitRefs":[{"url":"https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5","tags":[]},{"url":"https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows attackers with project write access to execute arbitrary code by exploiting a flaw in the JavaScript webhook template validator, which fails to block computed member access to constructor chains.","exploitability":"Exploitation is relatively straightforward for attackers with project write access, as the necessary conditions are already met by the required permissions.","blast_radius":"If exploited, this vulnerability could lead to complete compromise of the affected system, including execution of arbitrary code within the worker process.","remediation":"Disable the affected feature or restrict access to the webhook templates endpoint to users without project write access.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","auth-bypass"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-27T08:57:05.110Z"}}