CVE-2026-85610

OpenPanel versions before 2.3.0 fail to properly validate chart formula expressions, allowing users to escape the mathjs expression sandbox by recovering the native JavaScript Function constructor through mathjs matrix objects (CWE-94, improper code generation). The flaw is triggered over the network by any authenticated project member who has only read access, by submitting a crafted formula to the chart API, with no user interaction required. Once the sandbox is escaped, the attacker can load Node.js built-in modules and execute arbitrary operating-system commands with the privileges of the API process, and the attack bypasses organization authorization boundaries, meaning a low-privileged member of one organization can execute code outside their assigned scope. Any deployment running OpenPanel earlier than 2.3.0 that exposes chart functionality to authenticated users is affected. There is currently no known exploitation: the flaw is not in CISA KEV, no public proof-of-concept is available, and EPSS estimates roughly a 0.4% probability of exploitation in the next 30 days (33rd percentile), though the CVSS 4.0 score of 8.7 (High) reflects the serious impact on confidentiality, integrity, and availability of the vulnerable system.

What to do: Upgrade OpenPanel to version 2.3.0 or later, which properly validates chart formula expressions. Until patched, note that read-only project members are sufficient to exploit the flaw, so restrict API access to trusted users, run the API process under a least-privilege account to limit the blast radius of command execution, and monitor logs for unexpected OS command execution or Node.js built-in module loading from the API process. Organizations should also audit member lists to identify low-privilege accounts that can reach the chart API in environments that cannot patch immediately.