CVE-2026-93985: OpenPanel js-runtime Sandbox Escape to RCE

Overview

A critical sandbox escape vulnerability has been disclosed in OpenPanel's js-runtime component, tracked as CVE-2026-93985 and rated 9.9 (Critical) on CVSS 3.1 (9.4 under CVSS 4.0). The flaw sits in the JavaScript webhook template validator, which fails to block computed member access to JavaScript's constructor chain — letting an attacker with project write access reach the Function constructor and execute arbitrary code inside the worker process. It affects OpenPanel js-runtime through commit bad75bdd.

Technical Details

How It Works

OpenPanel lets project members define webhook templates that run inside a restricted JavaScript sandbox. The validator responsible for vetting these templates blocks direct references to dangerous properties — but it does not account for computed member access (bracket notation), where a property name is built dynamically instead of written literally.

By constructing a property path with bracket notation, an attacker can sidestep the blocklist and walk the constructor chain of an ordinary object up to Function, effectively obtaining a handle to JavaScript's Function constructor from inside the sandbox. From there, arbitrary code can be compiled and executed with the privileges of the worker process that runs webhook templates.

Because exploitation only requires project write access — a level of access many legitimate, lower-trust collaborators have — this turns a routine "create a webhook template" action into a path to full worker-process compromise.

Impact Assessment

Any OpenPanel deployment that allows non-administrative users to create or edit webhook templates is exposed to:

• Arbitrary code execution in the context of the webhook worker
• Potential lateral movement to other resources reachable from that worker (internal services, credentials, secrets available to the process)
• Abuse of the webhook execution pipeline as a foothold in multi-tenant or CI-adjacent environments

Because the bar for exploitation is "project write access" rather than admin/root, this is a meaningful privilege escalation primitive even in deployments that already restrict who can administer the panel itself.

Mitigation

• Update OpenPanel js-runtime to a version past commit bad75bdd that closes the computed-member-access gap — check the vendor's GitHub security advisory (GHSA-6f7h-cvp6-w9w5) for the patched release
• Until patched, restrict who can create or modify webhook templates to fully trusted, administrative accounts
• Audit existing webhook templates for suspicious bracket-notation property access (e.g. obj["constructor"]["constructor"]) or other dynamic property-name patterns
• Favor an allow-list of known-safe identifiers over a blocklist approach when validating any similarly sandboxed template or script input

References

• NVD — CVE-2026-93985
• GitHub Security Advisory GHSA-6f7h-cvp6-w9w5 (OpenPanel js-runtime)