CVE-2026-93985

9.9 CRITICALpublic exploit available

Published 2026-09-19 · Updated 2026-09-21

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-94

Public exploit & PoC references

https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5

All references

https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5
https://www.vulncheck.com/advisories/openpanel-js-runtime-javascript-template-sandbox-escape-rce
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-16623
HIGHCVE-2026-18770
HIGHCVE-2026-4327
HIGHCVE-2026-46581PoC
UNSCOREDCVE-2026-47781PoC
HIGHCVE-2026-51401PoC
HIGHCVE-2026-55071PoC
UNSCOREDCVE-2026-58074

Related by shared AI tags and CWE weakness class. Browse the full archive.