CVE-2026-93985

OpenPanel's js-runtime component, through commit bad75bdd, contains a sandbox escape (CWE-94) in its JavaScript webhook template validator, which fails to block computed member access to constructor chains. An attacker who holds project write access can create a webhook template that uses computed property notation to reach the Function constructor and execute arbitrary code inside the worker process. Successful exploitation yields full confidentiality, integrity, and availability impact on the worker and downstream scope, reflected in the critical CVSS 4.0 score of 9.4 (network vector, low complexity, low privileges, no user interaction). Any deployment running the affected js-runtime revision and allowing users or projects to define webhook templates is exposed. No public proof-of-concept is known, the issue is not in CISA KEV, and no in-the-wild exploitation has been reported.

What to do: Audit whether your deployment runs the js-runtime webhook template feature and restrict project write access to strictly trusted users until a fix lands, since no patched release or commit is specified in the available data. Track the upstream repository for commits after bad75bdd and update as soon as a fixed revision is published. As interim mitigation, disable or gate webhook template creation and review existing templates for computed member access to constructor chains.