CVE-2026-93985

CVSS 9.9 (critical) · published 2026-09-19

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.

Weakness: CWE-94

Source: NVD CVE-2026-93985

References

• https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5
• https://www.vulncheck.com/advisories/openpanel-js-runtime-javascript-template-sandbox-escape-rce
• https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.