CVE-2026-93985 Overview
CVE-2026-93985 is a sandbox escape vulnerability in the OpenPanel js-runtime JavaScript webhook template validator. The validator fails to block computed member access to constructor chains, allowing attackers with project write access to reach the Function constructor. This enables arbitrary code execution inside the worker process handling webhook templates. The flaw affects OpenPanel js-runtime through commit bad75bdd and is categorized as Code Injection under [CWE-94]. Successful exploitation grants attackers execution capabilities equivalent to the worker process, exposing project data, secrets, and downstream services connected to the OpenPanel deployment.
Critical Impact
Authenticated attackers with project write access can escape the JavaScript sandbox and execute arbitrary code in the OpenPanel worker process, compromising confidentiality, integrity, and availability across the affected system.
Affected Products
- OpenPanel js-runtime through commit bad75bdd
- OpenPanel deployments exposing the webhook template feature to project users
- Downstream services and secrets reachable from the OpenPanel worker process
Discovery Timeline
- 2026-09-19 - CVE-2026-93985 published to the National Vulnerability Database (NVD)
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-93985
Vulnerability Analysis
OpenPanel's js-runtime allows users to define webhook templates written in JavaScript. Before templates run in the worker sandbox, a validator inspects the abstract syntax tree (AST) to block access to dangerous globals such as constructor, Function, and process. The validator enforces these restrictions on static member access expressions like obj.constructor, but does not apply the same checks to computed member access expressions such as obj["constr" + "uctor"].
Attackers holding project write access can author a webhook template that uses computed property notation to traverse the prototype chain and reach the Function constructor. Once obtained, Function can be invoked to compile and execute arbitrary JavaScript inside the worker, bypassing the sandbox entirely. Because the worker process typically holds credentials, database connections, and network access to internal services, the impact extends well beyond the webhook feature itself.
Root Cause
The root cause is incomplete input validation in the template parser. The validator's denylist matches identifier nodes but ignores computed MemberExpression nodes whose property is a string literal or expression. This gap allows attackers to spell forbidden property names dynamically and evade the check.
Attack Vector
Exploitation requires an authenticated account with write permission to a project's webhook templates. The attacker submits a crafted template using computed member access to reach [].constructor.constructor("...") or an equivalent chain, then triggers webhook evaluation. The payload executes in the worker context on the next template run. See the GitHub Security Advisory GHSA-6f7h-cvp6-w9w5 and the VulnCheck Advisory on OpenPanel RCE for further technical detail.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-93985
Indicators of Compromise
- Webhook template source containing computed member access patterns such as ["constructor"], ["con"+"structor"], or bracket-notation access to prototype and Function.
- Unexpected outbound network connections, file writes, or child process activity originating from the OpenPanel worker process.
- New or modified webhook templates authored by low-privilege project accounts shortly before anomalous worker behavior.
Detection Strategies
- Perform AST-level review of stored webhook templates and flag any computed MemberExpression nodes whose evaluated property resolves to constructor, __proto__, prototype, Function, process, or require.
- Correlate webhook template create and update events with subsequent worker process syscall anomalies to identify post-write exploitation.
- Baseline normal worker process behavior and alert on deviations such as spawning shells, loading unexpected modules, or opening sockets to non-approved destinations.
Monitoring Recommendations
- Enable audit logging for all webhook template create, update, and execute operations, including author identity and full template content.
- Forward OpenPanel application logs and worker process telemetry to a centralized analytics platform for retention and correlation.
- Monitor for Function constructor invocations and eval usage in runtime logs from the js-runtime worker.
How to Mitigate CVE-2026-93985
Immediate Actions Required
- Update OpenPanel js-runtime to a commit that follows bad75bdd and includes the validator fix referenced in the vendor advisory.
- Audit existing webhook templates for computed member access patterns and remove any suspicious entries before restarting workers.
- Restrict project write access to trusted users and rotate any secrets accessible to the worker process if compromise is suspected.
Patch Information
Refer to the GitHub Security Advisory GHSA-6f7h-cvp6-w9w5 for the fixed commit and upgrade guidance. Deployments running commit bad75bdd or earlier remain vulnerable. Rebuild and redeploy worker containers after applying the patch so cached template evaluators are refreshed.
Workarounds
- Temporarily disable the JavaScript webhook template feature until the patched js-runtime is deployed.
- Restrict the webhook template editor role to administrators and revoke write access from standard project users.
- Run the OpenPanel worker under a hardened service account with no outbound internet access and minimal filesystem privileges to limit blast radius if the sandbox is escaped.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
