VulnSocial

CVE-2026-85610Disclosure

LOWCVSS 8.7 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to load Node.js built-ins and execute operating system commands with the privileges of the API process, bypassing organization authorization boundaries.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-08: 2PoC Mentioned / Linked · 2026-09-08: 1Patch / Workaround · 2026-09-08: 1Technical Details · 2026-09-08: 109-08
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • Devyn@devyn
    Disclosure

    First CVE. CVE-2026-85610 OpenPanel before 2.3.0 CWE-94 in chart formula evaluation Auth’d project reader could get RCE in the API process and break org isolation. Fixed in 2.3.0. Doesn’t hit like it would have before every model could spit out a finding. Still cool. First time seeing my handle on a CVE record. https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7476-c5cc-8999 https://www.cve.org/CVERecord?id=CVE-2026-85610

    Post summary

    CVE-2026-85610 is an RCE vulnerability (CWE‑94) in OpenPanel before 2.3.0, patched in 2.3.0, with a PoC link provided, but no active exploitation or false‑positive claim is reported.

    10020128
    299 followersView on X
  • Libert Tapia@liberttapia
    General

    openpanel before 2.3.0 https://www.cve.org/CVERecord?id=CVE-2026-85610

    Post summary

    The text only references the CVE identifier for OpenPanel versions prior to 2.3.0, with no additional context on exploitation or mitigation.

    1000050
    53 followersView on X

Explore more

Back to dashboard