Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-116811: OpenPanel before 3.0.0 lets insiders run code
CVE-2026-116811 · published 1 day ago
Summary
Versions of OpenPanel older than 3.0.0 contain a flaw that lets a user with write permission execute their own code on the server. This could allow the attacker to read or change data and affect other users. Upgrade to OpenPanel 3.0.0 or later, or restrict write access to trusted personnel, to mitigate the risk.
Original advisory text
OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template
OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker process.
References
- https://github.com/Openpanel-dev/openpanel/commit/42fc8623b5c5c30f0b89686451c0c5... Patch
- https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-mc99-9jf5-22... Vendor Advisory
- https://www.vulncheck.com/advisories/openpanel-before-3.0.0-sandbox-escape-rce-v... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-1168... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-116811 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-94Code Injection
Timeline
Published26 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Track software like this
Free during beta