CVE-2026-93985

If someone on your team can edit webhook templates, CVE-2026-93985 is a sandbox escape into the OpenPanel worker. The js-runtime validator blocks payload.constructor.constructor() but accepts the same chain with computed property access. That is RCE for project-write users, not a toy template bug. Upgrade past commit bad75bdd, and lock who can create webhook templates until you do. https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5

🚨 OpenPanel js-runtime #CVE-2026-93985: Analyzing and Mitigating the CVSS 99 Sandbox Escape RCE + Video -Prediction: 📈 1 Positive | 📉 1 Negative https://undercodetesting.com/openpanel-js-runtime-cve-2026-93985-analyzing-and-mitigating-the-cvss-99-sandbox-escape-rce-video/ Educational Purposes!

🚨 OPENPANEL JS-RUNTIME — CVSS 9.9 CVE-2026-93985: Sandbox escape payload.constructor.constructor() → BLOCKED payload['constructor']['constructor']() → ACCEPTED → https://threataft.com/articles/openpanel-js-runtime-cve-2026-93985-sandbox-escape #OpenPanel #CVE #RCE #SandboxEscape #PatchNow #CyberSecurity #ThreatIntel

CVE-2026-93985 OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member … https://www.cve.org/CVERecord?id=CVE-2026-93985

OpenPanel's 9.9 webhook RCE has no patched version — the project has never cut a release, so the CVE VulnCheck (@VulnCheckAI) published today names a git commit hash instead. No exploitation reported. https://severitydaily.com/openpanel-cve-2026-93985-webhook-sandbox-escape-no-patched-version-commit-hash/