CVE-2026-116811

8.8 HIGHpublic exploit available

Published 2026-10-27 · Updated 2026-10-27

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker process.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

Public exploit & PoC references

https://github.com/Openpanel-dev/openpanel/commit/42fc8623b5c5c30f0b89686451c0c5ab13046b81
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-mc99-9jf5-22cq

All references

https://github.com/Openpanel-dev/openpanel/commit/42fc8623b5c5c30f0b89686451c0c5ab13046b81
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-mc99-9jf5-22cq
https://www.vulncheck.com/advisories/openpanel-before-3.0.0-sandbox-escape-rce-via-webhook-javascript-template

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

CRITICALCVE-2021-48016PoC
CRITICALCVE-2024-31026
HIGHCVE-2024-42002PoC
LOWCVE-2024-4412PoC
UNSCOREDCVE-2025-30045
UNSCOREDCVE-2025-30050
HIGHCVE-2026-0322
MEDIUMCVE-2026-100152

Related by shared AI tags and CWE weakness class. Browse the full archive.