CVE-2026-93985: OpenPanel Sandbox Escape
TL;DR - CVE-2026-93985 is a critical sandbox escape in OpenPanel
js-runtime, with a CVSS score of 9.9. - Attackers need project write access and may execute arbitrary code in the worker process through a malicious webhook template. - No fixed version or verified public PoC is confirmed. Restrict access and isolate affected workers immediately.
Vulnerability at a Glance
| Field | Details |
|---|---|
| CVE ID | CVE-2026-93985 |
| Product | OpenPanel js-runtime |
| Vulnerability | JavaScript webhook-template sandbox escape leading to arbitrary code execution |
| CVSS score | 9.9, Critical |
| Attack vector | Not disclosed in the retrieved NVD summary; confirm against the full NVD record or maintainer advisory |
| Authentication or authorization required | Yes. The attacker requires project write access |
| Affected code | OpenPanel js-runtime through commit bad75bdd |
| Patch available | No confirmed fixed version or remediation commit identified |
| Public PoC | No verified public proof-of-concept repository identified |
| Active exploitation | Not confirmed; the CVE is not listed in CISA KEV |
CVE-2026-93985 affects the JavaScript runtime used to validate or process OpenPanel webhook templates. Based on the available description, this is not an unauthenticated attack: an attacker must first obtain project write access. That prerequisite may still be realistic in shared development environments, compromised administrator accounts, malicious-insider scenarios, or deployments where project permissions are broader than intended.
The available research identifies vulnerable code through commit bad75bdd, but does not provide a conventional semantic-version range or confirmed fixed release. Organizations should inventory the exact OpenPanel source revision or build deployed in their environments rather than relying only on package-version comparisons.
What Is CVE-2026-93985?
The vulnerability is a JavaScript sandbox escape caused by incomplete filtering of dangerous property access in the webhook-template validator. The validator apparently restricts direct references to sensitive constructor properties but does not adequately block computed member access. In JavaScript, computed property notation allows an expression to calculate a property name at runtime instead of writing the property name directly.
That gap can allow a malicious template to traverse constructor chains and obtain the built-in Function constructor. Once an attacker reaches Function, they can construct and execute attacker-controlled JavaScript inside the worker process. The result may be arbitrary code execution with the privileges, filesystem access, network access, environment variables, and service credentials available to that worker.
This is a sandbox-boundary failure, not merely a template-validation issue. A blacklist that blocks known strings or direct property names is not a reliable security boundary when the language permits alternate syntax and object-traversal paths. Defenders should assess the worker as a potentially exposed execution environment and determine what data and credentials are reachable from it.
Technical Notes: Root Cause
The vulnerable execution path can be summarized as:
Project write access
|
v
Create or modify webhook template
|
v
Computed member access bypasses validator
|
v
Reach JavaScript Function constructor
|
v
Execute attacker-controlled code in worker process
The specific malicious payload is not reproduced here because no verified public proof of concept was identified in the available research. The important detection and remediation point is the use of computed member access and constructor-chain traversal in webhook-template content, rather than dependence on one exact payload string.
Who Is Affected?
The affected product is OpenPanel’s js-runtime component. The NVD description identifies vulnerable code through commit bad75bdd. The retrieved records do not state a semantic version such as <= 1.2.3, and they do not identify a confirmed fixed commit or release. Deployments running code at commit bad75bdd, or builds containing the same vulnerable implementation, should therefore be treated as potentially affected.
The practical scope includes OpenPanel installations that enable JavaScript webhook templates and run those templates in a worker process. Deployments that do not expose webhook-template creation to untrusted or semi-trusted project users may have lower exploitation likelihood, but they should not be considered safe without confirming both access controls and the runtime implementation.
| Deployment condition | Assessment |
|---|---|
js-runtime contains or is based on commit bad75bdd |
Potentially affected |
| A later build is deployed, but no maintainer fix is documented | Fixed status unknown; verify the source diff or release notes |
| Webhook templates are enabled and editable by project contributors | Higher exposure |
| Worker has cloud credentials, API tokens, or broad network access | Higher impact if exploited |
| No user-controlled webhook templates are enabled | Exposure may be reduced, but inventory and configuration review are still required |
Until the maintainer publishes a fixed version or remediation commit, do not assume that upgrading to an arbitrary later build resolves the issue. Record the deployed commit, compare it with the eventual fix, and retain evidence of the upgrade for incident and change-management purposes.
CVSS Score Breakdown
The NVD record assigns CVE-2026-93985 a CVSS base score of 9.9, rated Critical. However, the retrieved NVD summary did not include the CVSS vector string. Therefore, the individual vector components—including network or local attack vector, complexity, user interaction, scope, and confidentiality, integrity, and availability impacts—cannot be stated reliably from the available data.
The known authorization prerequisite is project write access. That requirement is operationally important even though it does not, by itself, establish the full CVSS vector. Security teams should obtain the authoritative vector from the complete NVD record or the OpenPanel maintainer advisory before using the score in quantitative risk models, prioritization dashboards, or compliance reports.
| CVSS-related element | Confirmed information |
|---|---|
| Base score | 9.9 |
| Severity | Critical |
| Attack vector | Not available in the retrieved summary |
| Attack complexity | Not available |
| Privileges required | Project write access is required |
| User interaction | Not available |
| Scope | Not available |
| Confidentiality impact | Arbitrary code execution may expose worker-accessible data; formal vector component not confirmed |
| Integrity impact | Arbitrary code execution may permit unauthorized changes; formal vector component not confirmed |
| Availability impact | Worker disruption is possible; formal vector component not confirmed |
The high score is consistent with a sandbox escape that leads to arbitrary code execution, but defenders should not infer missing vector fields from the score alone. Use the confirmed technical prerequisite and the worker’s actual permissions to determine local business risk.
Exploitation Status
CVE-2026-93985 is not listed in the CISA Known Exploited Vulnerabilities catalog based on the available lookup. Consequently, there is no CISA KEV date added, due date, required action, or ransomware-campaign designation for this CVE at the time of research. This indicates that CISA has not confirmed the vulnerability through KEV; it is not proof that exploitation has never occurred.
No verified public proof-of-concept repository was identified in the retrieved search results. The vulnerability is nevertheless technically exploitable by a user with project write access, and the attack concept is understandable from the published root cause: bypass template validation with computed member access, reach Function, and execute code in the worker. Organizations should treat the issue as high risk even while exploit maturity remains unconfirmed.
Technical Notes: What to Monitor
Review project and webhook audit records for unexpected template creation or modification, especially by users who do not normally manage integrations. Correlate those changes with worker-process activity, outbound connections, child-process creation, access to environment variables, and reads of credential or configuration files.
Organizations building centralized monitoring can review what SIEM means and how it supports security monitoring before adapting the following generic query:
event.category = "configuration"
AND event.action IN ("webhook_template.create", "webhook_template.update")
AND (
event.user.id NOT IN approved_project_maintainers
OR webhook.template contains "__proto__"
OR webhook.template contains "constructor"
OR webhook.template contains "Function"
)
The field names above are illustrative because OpenPanel’s exact audit schema was not provided. Adapt the query to the deployed logging format, and do not treat the absence of these literal strings as evidence of safety. Computed access can be obfuscated or expressed in multiple equivalent forms.
How to Detect CVE-2026-93985
Start by identifying every OpenPanel deployment that uses js-runtime, then record the deployed image digest, package metadata, or source commit. For source-based installations, inspect the repository revision directly. For containers, inspect image labels and the binary or package contents used to build the image. A version inventory is necessary because the available advisory identifies a commit boundary rather than a standard release range.
# Source-based deployment: record the exact revision
git -C /opt/openpanel rev-parse HEAD
# Container deployment: record the immutable image reference
docker image inspect openpanel/js-runtime \
--format '{{.RepoTags}} {{.Id}} {{.RepoDigests}}'
# Kubernetes deployment: inspect the image actually configured
kubectl -n openpanel get deploy -o \
jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.template.spec.containers[*].image}{"\n"}{end}'
Next, search audit logs and application data for webhook-template changes during the period of concern. Look for newly created templates, modifications involving computed-property syntax, unexpected project writers, and activity occurring shortly after a template update. On the host or container platform, examine worker process trees and network telemetry for activity inconsistent with normal webhook processing.
# Example process-monitoring logic
parent_process = "openpanel-worker"
AND (
child_process != expected_worker_children
OR destination_domain NOT IN approved_webhook_destinations
OR process_command_line contains "sh"
OR process_command_line contains "curl"
OR process_command_line contains "wget"
)
This is a detection starting point, not a vendor-specific signature. Confirm normal worker behavior before alert tuning, and preserve the original template, audit event, worker logs, process metadata, and network-flow records if suspicious activity is found.
Mitigation and Patching
No confirmed fixed version was identified in the retrieved NVD data or referenced advisory material. The known affected boundary is OpenPanel js-runtime through commit bad75bdd. Until OpenPanel publishes a fixed commit or release, administrators should treat affected deployments as unpatched and apply compensating controls.
The most important immediate control is to restrict project write access to trusted, strongly authenticated users. Review inherited permissions, service accounts, automation tokens, and external collaborators. Where practical, disable user-controlled webhook-template creation or route templates through an administrative approval process. If webhook functionality is not essential, disable the affected execution path until a fix is available.
If exposed credentials may have been stored or accessed by the worker, follow a documented rotation process such as this guide to rotating credentials after exposure. Teams can also evaluate a managed endpoint-security product such as Get Malwarebytes → as one layer of broader monitoring, but endpoint tooling does not replace application-level access controls or worker isolation.
Technical Notes: Upgrade and Workaround
Because no fixed version or remediation commit has been confirmed, do not use an invented version number or assume that a generic package upgrade resolves the issue. First capture the current revision, then apply the maintainer’s documented fixed commit or release when available:
# Record the current revision before changing the deployment
git -C /opt/openpanel rev-parse HEAD
# After the maintainer publishes a confirmed fixed commit:
git -C /opt/openpanel fetch --tags origin
git -C /opt/openpanel checkout <CONFIRMED_FIXED_COMMIT_OR_TAG>
git -C /opt/openpanel build # Use the project's documented build command
Replace the placeholder only with a commit or tag confirmed by the OpenPanel advisory or repository history. For containerized deployments, update the image reference to the confirmed fixed tag or digest, redeploy, and verify that the running workload uses the new immutable image.
Until then, use a layered workaround:
1. Remove project-write permissions from untrusted users.
2. Disable webhook-template editing or execution where operationally possible.
3. Run workers as a non-root user.
4. Remove unnecessary environment variables and service credentials.
5. Apply filesystem read-only controls where compatible.
6. Restrict egress to approved webhook destinations.
7. Isolate workers from control-plane and metadata services.
8. Alert on webhook-template changes and unusual worker activity.
If exploitation is suspected, isolate the worker, preserve logs and container or host evidence, revoke and rotate credentials accessible to that process, and review outbound connections and downstream service activity. Because arbitrary code execution may expose secrets without leaving obvious application errors, rotate credentials based on reachability and exposure, not only on confirmed theft.
For organizations reviewing their broader secrets-management practices, a password manager such as Try 1Password → may help centralize access and reduce credential reuse. It should be used alongside short-lived tokens, least privilege, workload identity, and rapid revocation procedures.
References
The primary references for this issue are the OpenPanel GitHub security advisory, the NVD record, the VulnCheck advisory, and the CISA KEV catalog. The NVD record is the source for the CVE identifier and 9.9 score, while the project advisory should be treated as the authoritative source for the eventual fixed commit or release.
- OpenPanel GitHub security advisory
- NVD: CVE-2026-93985
- VulnCheck advisory: OpenPanel js-runtime JavaScript template sandbox escape
- CISA Known Exploited Vulnerabilities Catalog
The available records do not confirm a fixed version, a complete CVSS vector, a verified public PoC, or exploitation in the wild. Recheck the project advisory and NVD record before closing the vulnerability, documenting compliance status, or downgrading the operational priority.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.