EXPOSURES › CVE-2026-93985
CVE-2026-93985
CRITICALOpenPanel's JavaScript runtime allows sandbox escape via computed property notation in webhook templates, enabling arbitrary code execution in the worker process.
Attackers with project write access can craft webhook templates using computed property notation to access the Function constructor and execute arbitrary code in the worker process. This is a critical RCE vulnerability that violates secure coding practices and exposes systems to remote code execution. DIB organizations must ensure their software supply chain includes rigorous code review and sandbox validation to prevent similar escapes.
Shame score — A critical RCE vulnerability in a JavaScript runtime that allows arbitrary code execution via a simple template manipulation, indicating a severe failure in secure coding and sandbox enforcement.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.