CVE-2026-93985Disclosure

LOWCVSS 9.4 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
7 mentions across 4 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 7 signals
Disclosure: 5 classified signals
Peaked 2d ago at 3 mentions (2026-09-20); latest day: 1
7 total mentions across 4 days

Deep dive

Activity timeline7 mentions / 4d

Signal classification3 categories

Disclosure

571.4%

Patch

114.3%

PoC

114.3%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-19	2	Disclosure2
2026-09-20	3	Disclosure1Patch1PoC1
2026-09-22	1	Disclosure1
2026-10-26	1	Disclosure1

Full discourse7 posts

Hugo | DevOps | Cybersecurity@HugoValters9d
Disclosure
CVE-2026-93985 OpenPanel js-runtime sandbox escape: computed property access reaches the Function constructor, letting project writers run arbitrary code in the worker. CVSS 9.9, unpatched. Restrict write access and patch now. https://www.valtersit.com/cve/CVE-2026-93985 #OpenPanel #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The post discloses CVE-2026-93985 as a critical sandbox escape in OpenPanel with CVSS 9.9, technical details, and a call to patch, but lacks explicit PoC, exploit tools, or active exploitation evidence. Classification as 'Disclosure' is appropriate given the technical details and advisory tone.
0001036
1.1K followersView on X
Cybersecurity News DE@cybsecuritynews43d
Disclosure
#schwachstellen OpenPanel: Kritische Sandbox-Flucht in js-runtime ermöglicht Codeausführung #cve202693985 #jsruntime #nvd #openpanel https://cybersecurity-news.de/openpanel-cve-2026-93985-sandbox-flucht-js-runtime
Post summary
The tweet announces the disclosure of CVE-2026-93985, a critical sandbox escape vulnerability in OpenPanel's js-runtime component that enables code execution, citing technical details and linking to a cybersecurity news article. No explicit mention of PoC, exploits, patches, or active exploitation is provided in the text itself.
0000028
13 followersView on X
Anthony Bahn@HoustonIntrove146d
Patch
If someone on your team can edit webhook templates, CVE-2026-93985 is a sandbox escape into the OpenPanel worker. The js-runtime validator blocks payload.constructor.constructor() but accepts the same chain with computed property access. That is RCE for project-write users, not a toy template bug. Upgrade past commit bad75bdd, and lock who can create webhook templates until you do. https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5
Post summary
The text discloses CVE-2026-93985 as a sandbox escape RCE vulnerability in OpenPanel, details a JavaScript runtime validator bypass, and explicitly recommends upgrading past commit bad75bdd while restricting webhook template creation, accompanied by a vendor advisory link.
0000046
36 followersView on X
UNDERCODE TESTING@UndercodeUpdate46d
Disclosure
🚨 OpenPanel js-runtime #CVE-2026-93985: Analyzing and Mitigating the CVSS 99 Sandbox Escape RCE + Video -Prediction: 📈 1 Positive | 📉 1 Negative https://undercodetesting.com/openpanel-js-runtime-cve-2026-93985-analyzing-and-mitigating-the-cvss-99-sandbox-escape-rce-video/ Educational Purposes!
Post summary
The tweet references CVE‑2026‑93985 as a CVSS 99 sandbox‑escape RCE and links to an analysis page, but it contains no PoC, exploit tool, active exploitation claim, patch, or false‑positive indication, leading to a Disclosure classification with medium confidence.
0000055
749 followersView on X
ThreatAft@ThreatAft46d
PoC
🚨 OPENPANEL JS-RUNTIME — CVSS 9.9 CVE-2026-93985: Sandbox escape payload.constructor.constructor() → BLOCKED payload['constructor']['constructor']() → ACCEPTED → https://threataft.com/articles/openpanel-js-runtime-cve-2026-93985-sandbox-escape #OpenPanel #CVE #RCE #SandboxEscape #PatchNow #CyberSecurity #ThreatIntel
Post summary
The text discloses CVE-2026-93985, a CVSS 9.9 sandbox escape vulnerability in OpenPanel JS-Runtime, and explicitly shares a proof-of-concept bypass technique. No named exploit tool, active exploitation, or vendor patch is indicated.
0000056
44 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-93985 OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member … https://www.cve.org/CVERecord?id=CVE-2026-93985
Post summary
The text announces CVE-2026-93985, detailing a sandbox escape vulnerability in OpenPanel js-runtime caused by insufficient validation in the JavaScript webhook template validator, without mentioning patches, exploits, or active exploitation.
000001.8K
58.1K followersView on X
Severity Daily@severitydaily46d
Disclosure
OpenPanel's 9.9 webhook RCE has no patched version — the project has never cut a release, so the CVE VulnCheck (@VulnCheckAI) published today names a git commit hash instead. No exploitation reported. https://severitydaily.com/openpanel-cve-2026-93985-webhook-sandbox-escape-no-patched-version-commit-hash/
Post summary
The text discloses CVE-2026-93985 for OpenPanel's webhook RCE, highlighting that no patched version exists and no exploitation has been reported.
0000034
24 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-93985

Hugo | DevOps | Cybersecurity[verified]@HugoValtersDisclosure

The post discloses CVE-2026-93985 as a critical sandbox escape in OpenPanel with CVSS 9.9, technical details, and a call to patch, but lacks explicit PoC, exploit tools, or active exploitation evidence. Classification as 'Disclosure' is appropriate given the technical details and advisory tone.

Anthony Bahn[verified]@HoustonIntrove1Patch

The text discloses CVE-2026-93985 as a sandbox escape RCE vulnerability in OpenPanel, details a JavaScript runtime validator bypass, and explicitly recommends upgrading past commit bad75bdd while restricting webhook template creation, accompanied by a vendor advisory link.

Severity Daily[verified]@severitydailyDisclosure

The text discloses CVE-2026-93985 for OpenPanel's webhook RCE, highlighting that no patched version exists and no exploitation has been reported.

Cybersecurity News DE@cybsecuritynewsDisclosure

The tweet announces the disclosure of CVE-2026-93985, a critical sandbox escape vulnerability in OpenPanel's js-runtime component that enables code execution, citing technical details and linking to a cybersecurity news article. No explicit mention of PoC, exploits, patches, or active exploitation is provided in the text itself.

UNDERCODE TESTING@UndercodeUpdateDisclosure

The tweet references CVE‑2026‑93985 as a CVSS 99 sandbox‑escape RCE and links to an analysis page, but it contains no PoC, exploit tool, active exploitation claim, patch, or false‑positive indication, leading to a Disclosure classification with medium confidence.

ThreatAft@ThreatAftPoC

The text discloses CVE-2026-93985, a CVSS 9.9 sandbox escape vulnerability in OpenPanel JS-Runtime, and explicitly shares a proof-of-concept bypass technique. No named exploit tool, active exploitation, or vendor patch is indicated.

CVE@CVEnewDisclosure

The text announces CVE-2026-93985, detailing a sandbox escape vulnerability in OpenPanel js-runtime caused by insufficient validation in the JavaScript webhook template validator, without mentioning patches, exploits, or active exploitation.