Is CVE-2026-93985 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93985 being exploited in the wild.

How severe is CVE-2026-93985?

Critical severity, with a CVSS score of 9.9, published 19 September 2026.

Which products and versions are affected?

OpenPanel Js-Runtime through commit bad75bdd.

Is there a fix for CVE-2026-93985?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93985 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-93985?

Check whether you run OpenPanel Js-Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93985: OpenPanel js-runtime sandbox escape in JavaScript webhook validator

CVE-2026-93985 · Severity: critical · CVSS 9.9 · Published 2026-09-19

OpenPanel's webhook integration feature lets project writers define JavaScript templates that validate and execute event handlers. A flaw in the sandbox allowlist fails to block computed property access to the Function constructor, allowing attackers with project write access to execute arbitrary code with the privileges of the shared worker process, potentially accessing shared database credentials and all tenant data.

Vendors: OpenPanel.

Quick answers

Is CVE-2026-93985 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93985 being exploited in the wild.
How severe is CVE-2026-93985?: Critical severity, with a CVSS score of 9.9, published 19 September 2026.
Which products and versions are affected?: OpenPanel Js-Runtime through commit bad75bdd.
Is there a fix for CVE-2026-93985?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93985 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-93985?: Check whether you run OpenPanel Js-Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the validate() function of @openpanel/js-runtime, which walks a Babel AST with an allowlist to block dangerous calls (eval, Function, process, .constructor). The check only inspects non-computed member identifiers, so computed access like payload['constructor']['constructor'] bypasses validation. Attackers with project write access can craft webhook templates using computed property notation to access the Function constructor and invoke arbitrary code, which is then executed during notification delivery in the worker process without re-validation.

Affected products

OpenPanel js-runtime through commit bad75bdd

Timeline

2026-09-19: disclosed
2026-09-04: advisory: GitHub Security Advisory GHSA-6f7h-cvp6-w9w5 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.