CVE-2026-85610High· 8.8▾ TwilightOpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.7%
OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to load Node.js built-ins and execute operating system commands with the privileges of the API process, bypassing organization authorization boundaries.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116811High· 8.8OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template
CVE-2026-93985Critical· 9.9OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains
CVE-2026-116813Medium· 6.5OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts
CVE-2026-116805Medium· 4.3OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list
CVE-2026-116809Medium· 5.3OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure
CVE-2026-116818High· 8.2OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket