EUVD-2026-83590
GHSA-rqpr-2wvr-29pf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable webhook feature (AV:N), straightforward validator bypass (AC:L), requires project-write account (PR:L), and sandbox escape into the worker crosses a trust boundary (S:C) yielding full code execution (C/I/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.
AnalysisAI
Code execution in OpenPanel's js-runtime component lets an authenticated user who holds project write access escape the JavaScript webhook template sandbox and run arbitrary code inside the worker process. The template validator fails to block computed (bracket-notation) member access that traverses a constructor chain to the Function constructor, so merely creating or editing a webhook template is sufficient - no user interaction is required (UI:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated user with project write access on an OpenPanel instance running js-runtime through commit bad75bdd, plus the ability to create or edit JavaScript webhook templates. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the advisory GHSA-6f7h-cvp6-w9w5 should be monitored for a fixed commit or tagged release, and the exact remediation version should be taken from that advisory rather than assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every OpenPanel deployment and confirm which ones run the js-runtime component with webhook templating enabled; enumerate all accounts holding project write access and, where business operations allow, disable webhook template creation and editing outright or remove write permissions from non-essential users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated h
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated m
Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges
Server-side request forgery in OpenPanel before 2.3.0 lets unauthenticated remote attackers coerce the panel server into
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the m
Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly
Unauthenticated information disclosure in OpenPanel (openpanel-dev/openpanel) exposes argon2id password hashes and full
Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped re
Unauthenticated XSS in OpenPanel before 2.3.0 allows remote attackers to execute arbitrary JavaScript in a victim's brow
OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to
Unauthenticated full-read SSRF in Openpanel before 2.3.0 enables remote attackers to issue arbitrary server-side HTTP re
Authentication bypass in the OpenPanel tracking API allows unauthenticated remote attackers to inject forged revenue met
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today