Description

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to load Node.js built-ins and execute operating system commands with the privileges of the API process, bypassing organization authorization boundaries.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-04T12:17:24.463Z",
  "pubdate": "2026-09-04T12:17:24.463Z",
  "executiveSummary": "OpenPanel versions prior to 2.3.0 are vulnerable to Remote Code Execution (RCE) via improper validation of chart formula expressions.\nThe vulnerability originates from the unsafe handling of user-supplied input within the mathjs library implementation.\nAuthenticated project members with read-level access can leverage this flaw to escape sandbox restrictions and obtain arbitrary code execution.\nBy recovering the native JavaScript Function constructor through specifically crafted mathjs matrix objects, an attacker can access sensitive Node.js internals.\nSuccessful exploitation allows for the execution of arbitrary operating system commands with the privileges of the underlying API process.\nThis vulnerability bypasses organization-level authorization boundaries, posing a critical risk to the integrity, confidentiality, and availability of the host environment.\nExploitation requires authentication as a project member, but no administrative privileges are necessary to trigger the command execution.",
  "technicalDetails": "The vulnerability exists within the chart formula evaluation logic of OpenPanel, which utilizes the mathjs library to process user-defined expressions. The root cause is a failure to implement proper input sanitization or sandboxing when passing formula strings to the mathjs evaluator.\nThe attack vector centers on the ability to manipulate mathjs matrix objects to escape the application's intended scope. Specifically, the attacker can leverage the constructor property associated with these objects to traverse the prototype chain and reach the native JavaScript Function constructor.\nOnce the Function constructor is accessed, the attacker is no longer constrained by the mathjs sandbox. The attacker can then define new functions containing arbitrary JavaScript code that executes within the Node.js runtime environment of the API process.\nThe exploitation flow proceeds as follows: First, the attacker provides a crafted chart formula string containing malicious mathjs syntax. Second, the mathjs engine processes this input, permitting the attacker to obtain a reference to the global object or the Function constructor via the matrix manipulation chain. Third, the attacker calls the constructor to instantiate a function that requires Node.js built-in modules, such as 'child_process' or 'fs'. Fourth, the attacker executes the injected code to perform OS-level commands, such as establishing a reverse shell, exfiltrating data, or modifying application configurations.\nBecause the API process typically runs with significant system privileges, the injected commands inherit these permissions, allowing the attacker to bypass internal application security boundaries and gain full control over the underlying server instance. The flaw affects all versions of OpenPanel prior to 2.3.0. The exploit does not require elevated administrative roles, as standard read-access project memberships provide sufficient entry to supply the malicious formula input.\nPost-exploitation impact is severe, as the attacker effectively escapes the application layer, gaining direct interaction with the host operating system to install persistent backdoors or move laterally within the network infrastructure."
}