CVE-2026-93985

Summary

This vulnerability allows attackers with project write access to execute arbitrary code by exploiting a flaw in the JavaScript webhook template validator, which fails to block computed member access to constructor chains.

Exploitability

Exploitation is relatively straightforward for attackers with project write access, as the necessary conditions are already met by the required permissions.

Blast radius

If exploited, this vulnerability could lead to complete compromise of the affected system, including execution of arbitrary code within the worker process.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected feature or restrict access to the webhook templates endpoint to users without project write access.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.