Skip to content
COOEY

EXPOSURES › CVE-2026-93985

CVE-2026-93985

CRITICAL
DETAIL
SourceNVD · cve Published2026-09-19 CVSS9.9 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-93985 ↗
⚡ RCE SHAME 85/100 rceexploited-in-wild

OpenPanel's JavaScript runtime allows sandbox escape via computed property notation in webhook templates, enabling arbitrary code execution in the worker process.

Attackers with project write access can craft webhook templates using computed property notation to access the Function constructor and execute arbitrary code in the worker process. This is a critical RCE vulnerability that violates secure coding practices and exposes systems to remote code execution. DIB organizations must ensure their software supply chain includes rigorous code review and sandbox validation to prevent similar escapes.

Shame score — A critical RCE vulnerability in a JavaScript runtime that allows arbitrary code execution via a simple template manipulation, indicating a severe failure in secure coding and sandbox enforcement.

▸ RECOMMENDED ACTION  Remote code execution — patch the affected products on priority.

DESCRIPTION

OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.

AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.