CVE-2026-116811: OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template

Q: Who can exploit this issue?

A project member with write access is required. The attacker must be able to supply JavaScript in a webhook template that is processed by the js-runtime validator.

Q: Which deployments are affected?

OpenPanel versions before 3.0.0 are affected. The provided information does not state whether any particular default configuration enables or disables the vulnerable webhook template functionality.

Q: What access does successful exploitation provide?

Successful exploitation allows arbitrary code execution in the worker process. The reported impact includes high confidentiality, integrity, and availability impact.

Q: What should teams do if they cannot upgrade immediately?

The provided information does not document a workaround. Until an upgrade is possible, limit project write access to trusted users and restrict access to webhook JavaScript template creation or modification where operationally feasible.

Published Oct 26, 2026

Updated

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker process.

Affected Software

1 affected component

OpenPanel OpenPanel<3.0.0

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A project member with write access is required. The attacker must be able to supply JavaScript in a webhook template that is processed by the js-runtime validator.

Which deployments are affected?

OpenPanel versions before 3.0.0 are affected. The provided information does not state whether any particular default configuration enables or disables the vulnerable webhook template functionality.

What access does successful exploitation provide?

Successful exploitation allows arbitrary code execution in the worker process. The reported impact includes high confidentiality, integrity, and availability impact.

What should teams do if they cannot upgrade immediately?

The provided information does not document a workaround. Until an upgrade is possible, limit project write access to trusted users and restrict access to webhook JavaScript template creation or modification where operationally feasible.

CVE-2026-116811: OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What access does successful exploitation provide?

What should teams do if they cannot upgrade immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What access does successful exploitation provide?

What should teams do if they cannot upgrade immediately?