CVE-2026-93985— OpenPanel js-runtime JavaScript Template Sandbox Escape RCE
Quick assessment
Affected
Openpanel-dev openpanel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenPanel 在提交 bad75bdd 之前的 js-runtime 版本中，JavaScript Webhook 模板验证器存在一个沙箱逃逸漏洞，该验证器未能阻止通过计算属性访问构造函数链。拥有项目写权限的攻击者可以利用计算属性符号访问 构造函数，从而在 worker 进程中执行任意代码。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93985
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenPanel js-runtime JavaScript Template Sandbox Escape RCE
Source: CVE Program / CVE List V5
Vulnerability Description
OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Openpanel-dev | openpanel | 0 ~ bad75bddc74d12d36cfb843f4531d3b830a8d994 | - |
|
II. Public POCs for CVE-2026-93985
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93985
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-93985 (2)
Same Patch Batch · Openpanel-dev · 2026-09-19 · 4 CVEs total
| CVE-2026-93984 | 5.3 MEDIUM | OpenPanel API Authentication Bypass via Unverified Client Secret |
| CVE-2026-93983 | 5.0 MEDIUM | OpenPanel SQL Injection via ClickHouse Property Key Filter |
| CVE-2026-93982 | 3.3 LOW | OpenPanel MCP Authentication Token in Query Parameter Logged Plaintext |
IV. Related Vulnerabilities
Same product: openpanel
-
CVE-2026-93983
OpenPanel SQL Injection via ClickHouse Property Key Filter -
CVE-2026-93984
OpenPanel API Authentication Bypass via Unverified Client Se -
CVE-2026-93982
OpenPanel MCP Authentication Token in Query Parameter Logged -
CVE-2026-88893
OpenPanel Unauthenticated Share Lookup Information Disclosur -
CVE-2026-88892
OpenPanel SSRF via Unguarded Importer File URL Fetch
Same vendor: Openpanel-dev
-
CVE-2026-93983
OpenPanel SQL Injection via ClickHouse Property Key Filter -
CVE-2026-93984
OpenPanel API Authentication Bypass via Unverified Client Se -
CVE-2026-93982
OpenPanel MCP Authentication Token in Query Parameter Logged -
CVE-2026-88893
OpenPanel Unauthenticated Share Lookup Information Disclosur -
CVE-2026-88892
OpenPanel SSRF via Unguarded Importer File URL Fetch
Same weakness: CWE-94
-
CVE-2026-85658
Paid Membership Plugin, Ecommerce, User Registration Form, L -
CVE-2026-4327
The Welcomizer <= 2.8.1 - Missing Authorization to Authentic -
CVE-2026-92807
Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Con -
CVE-2026-89274
WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortc -
CVE-2026-92229
Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Short
V. Comments for CVE-2026-93985
No comments yet