Sandbox Escape in OpenPanel js-runtime via Webhook Template Validator

CVE-2026-93985 describes a critical sandbox escape vulnerability in the OpenPanel js-runtime, affecting all versions up to commit bad75bdd. The vulnerability resides within the JavaScript webhook template validator, which does not properly restrict computed member access to constructor chains. By leveraging computed property notation within a webhook template, an authenticated attacker with project write access can bypass sandbox restrictions to reach the Function constructor. This allows for the execution of arbitrary JavaScript code within the context of the underlying worker process. This vulnerability is highly impactful due to the direct escalation from project-level write access to system-level code execution within the worker environment.

Attack Chain

1. Attacker gains authenticated access to an OpenPanel instance with 'project write' permissions.
2. Attacker navigates to the webhook template management interface.
3. Attacker crafts a malicious JavaScript payload utilizing computed property notation (e.g., [constructor]).
4. Attacker saves the payload into a webhook template.
5. The OpenPanel js-runtime triggers the validator to process the template.
6. The validator fails to block the access to the Function constructor chain.
7. The runtime executes the attacker-controlled code within the worker process.

Impact

Successful exploitation grants an attacker arbitrary code execution capabilities within the worker process of the OpenPanel js-runtime. This could lead to sensitive data exfiltration, lateral movement within the infrastructure, or service disruption. Given the high CVSS score of 9.9, the risk to organizations utilizing OpenPanel for webhook management is critical, as it bypasses intended security boundaries.

Recommendation

Prioritized actions for security teams:

• Identify and audit all existing webhook templates created or modified by non-administrative users.
• Patch OpenPanel js-runtime to a version beyond commit bad75bdd immediately once a fix is provided by the vendor.
• Implement strict ingress filtering for the OpenPanel management interface to limit potential unauthorized project-level access.
• Review worker process permissions to enforce the principle of least privilege, minimizing the potential impact of an arbitrary code execution event.