CVE-2026-116811: OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-31
Weakness: CWE-94

Description

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker process.

Affected products

Openpanel-dev openpanel: before 3.0.0 — fixed in 3.0.0

How to fix

Upgrade to a fixed version: Openpanel-dev openpanel 3.0.0. Check the vendor advisory for mitigations.

References

https://github.com/Openpanel-dev/openpanel/commit/42fc8623b5c5c30f0b89686451c0c5ab13046b81
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-mc99-9jf5-22cq
https://www.vulncheck.com/advisories/openpanel-before-3.0.0-sandbox-escape-rce-via-webhook-javascript-template

Get alerted when CVE-2026-116811 or the next vulnerability affects your stack