Live › vulnerability › CVE-2026-116811
Go to dashboardOpenPanel before 3.0.0 has a sandbox escape in its js-runtime validator: the AST allowlist can be bypassed by aliasing the Function constructor. A project member with write access can then run arbitrary code in the worker process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Teams running self-hosted OpenPanel before 3.0.0 where project members can write js-runtime code. The sources do not say whether the js-runtime is enabled by default. Instances on 3.0.0 or later are not affected.
No product ranges from the sources yet.
3.0.0 are affected.3.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker process.
This page as .md · .json · in your agent: get_signal("CVE-2026-116811")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.