rootpwn

critical · CVSS v3 9.9 · CVSS v4 9.4

CVE-2026-93985

OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability within its JavaScript webhook template validator. The f

Overview

OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability within its JavaScript webhook template validator. The flaw stems from a failure to block computed member access to constructor chains, enabling unauthorized execution. This allows attackers with project write access to compromise the worker process.

Description

OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.

Impact

This vulnerability impacts the Confidentiality, Integrity, and Availability of the host system by allowing arbitrary code execution within the worker process. Specifically, authenticated attackers with project write access can achieve sandbox escapes. Defenders face total worker compromise if left unmitigated.

Remediation

Apply the latest patches or updates provided by the vendor to address the sandbox escape in the JavaScript webhook template validator. Audit user permissions to ensure only trusted personnel possess project write access. Review existing webhook templates for anomalous use of computed property notation.

Risk context

Rated as critical with a CVSS v3 score of 9.9 and CVSS v4 score of 9.4, representing severe risk despite an unavailable EPSS score. Immediate patching is recommended due to the high severity and potential for arbitrary code execution.

Affected products

  • OpenPanel js-runtime

Scores

Severity
critical
CVSS v2
9
CVSS v3
9.9
CVSS v4
9.4
EPSS
—

sandbox-escape rce javascript webhook critical openpanel

← All CVEs

Related CVEs

critical

CVE-2026-89274

The WP Recipe Maker plugin for WordPress up to version 10.8.1 insecurely executes shortcodes found within structured recipe metadata fields derived from user comments. This allows unauthenticated users to trigger server-side shortcode execution and potentially disclose sensitive data through page metadata. Exploitation relies on the malicious comment passing the site's comment approval process.

View analysis

critical

CVE-2026-92229

The Forminator Forms plugin for WordPress contains an arbitrary shortcode execution vulnerability affecting versions up to 1.57.2. The issue stems from insufficient validation of user-supplied values prior to executing the do_shortcode function. This flaw allows unauthenticated remote attackers to execute arbitrary shortcodes within the application context.

View analysis

critical

CVE-2026-92807

The Save as PDF Plugin by PDFCrowd for WordPress suffers from an arbitrary function invocation vulnerability in versions up to 4.6.1. The flaw occurs because user-supplied shortcode attributes are unsanitized and later invoked as PHP callables via an unauthenticated AJAX endpoint. This allows low-privileged authenticated users to trigger unauthorized function executions and potentially disclose sensitive API credentials.

View analysis

critical

CVE-2026-93741

A critical stack-based buffer overflow vulnerability exists in the Totolink A3002MU router firmware within the formWlWds function. Specifically, improper handling of the submit-url parameter in requests to the /boafrm/formWlWds endpoint allows remote attackers to trigger memory corruption. This matters because successful exploitation could lead to arbitrary code execution or complete device compromise without authentication.

View analysis