Executive brief
OpenPanel's webhook integration feature lets project writers define JavaScript templates that validate and execute event handlers. A flaw in the sandbox allowlist fails to block computed property access to the Function constructor, allowing attackers with project write access to execute arbitrary code with the privileges of the shared worker process, potentially accessing shared database credentials and all tenant data.
Technical details
The vulnerability exists in the validate() function of @openpanel/js-runtime, which walks a Babel AST with an allowlist to block dangerous calls (eval, Function, process, .constructor). The check only inspects non-computed member identifiers, so computed access like payload['constructor']['constructor'] bypasses validation. Attackers with project write access can craft webhook templates using computed property notation to access the Function constructor and invoke arbitrary code, which is then executed during notification delivery in the worker process without re-validation.
Affected products
- OpenPanel js-runtime through commit bad75bdd
Timeline
- 2026-09-19: disclosed
- 2026-09-04: advisory: GitHub Security Advisory GHSA-6f7h-cvp6-w9w5 published