OpenPanel: Sandbox escape leading to remote code execution in webhook templates
Summary
OpenPanel before 3.0.0 contains a sandbox escape in the validator of JavaScript webhook templates. An authenticated project member with write access can bypass the AST allowlist by aliasing the Function constructor and run arbitrary code in the worker process. The worker holds database, ClickHouse, Redis and third-party integration credentials, so a successful attack can expose or misuse these secrets.
Affected
- OpenPanel versions before 3.0.0 (affected range 0 to less than 3.0.0 per CVE record)
- Rolling main image builds from 286f8e16 (2026-01-23) through 61a92453 (2026-09-18), per GitHub advisory GHSA-mc99-9jf5-22cq
Fixed in
- Upgrade to OpenPanel 3.0.0 or later (vendor-recommended action)
- Fix commit: 42fc8623b5c5c30f0b89686451c0c5ab13046b81
- Not verified: whether the 3.0.0 release tag contains this commit
Workaround
Unknown. No vendor-documented workaround is available; patching is the only remediation in the sources.
Exploitation
- CISA SSVC: exploitation status 'poc' (proof of concept public), not automatable, total technical impact
- EPSS: 0.49 % (percentile 42)
- No confirmed exploitation in the wild known at the time of writing
Our recommendation
- Upgrade OpenPanel to 3.0.0 or later; if you run main or rolling images, rebuild from a commit after 61a92453 that includes the fix
- Until patched, limit who can create or edit webhook integrations and JavaScript templates
- Review existing webhook templates for references to constructor, __proto__ or prototype
- Rotate database, Redis and integration credentials if untrusted users had template access
- Monitor worker logs for unexpected process or network activity
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-mc99-9jf5-22cq github.com
- Fix commit 42fc8623 (OpenPanel) github.com
- VulnCheck advisory: OpenPanel sandbox escape RCE via webhook JavaScript template www.vulncheck.com
- CIRCL vulnerability lookup (CWE-94) vulnerability.circl.lu
- OpenPanel pull request 510 (validator fix) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:04.
Original description (NVD)
OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker process.
NVD references (3)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.