Description

OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-19T12:16:41.873Z",
  "pubdate": "2026-09-19T12:16:41.873Z",
  "executiveSummary": "OpenPanel js-runtime contains a critical sandbox escape vulnerability within its JavaScript webhook template validator, affecting versions up to commit bad75bdd. The flaw arises from inadequate filtering of computed member access, which allows an attacker to traverse the object prototype chain and access sensitive constructors.\nBy leveraging this vulnerability, an attacker with project write access can bypass existing sandbox restrictions to execute arbitrary code within the context of the underlying worker process. This represents a significant security breach, as the ability to break out of the JavaScript execution environment allows for unauthorized access to system resources or potential escalation within the host infrastructure.\nThe vulnerability is primarily triggered through the crafting of malicious webhook templates using computed property notation. Once executed, the code runs with the privileges of the worker process, potentially compromising the integrity and confidentiality of the entire OpenPanel installation. Remediation is necessary to prevent exploitation by malicious actors who have gained authorized access to project-level functionalities.",
  "technicalDetails": "The vulnerability originates in the OpenPanel js-runtime's template validator, which is responsible for sanitizing user-provided JavaScript code for webhook executions. The root cause is a blacklist-based validation mechanism that fails to account for computed member access syntax (e.g., object['property']). While the validator may block standard dot-notation access to sensitive constructors, it does not sufficiently restrict the usage of bracket notation to navigate the prototype chain.\nAn attacker with project write access can supply a specially crafted template that uses computed property notation to access the Function constructor through object prototypes, such as [][('constr' + 'uctor')]('return process.env')(). By dynamically constructing string references, the attacker bypasses static analysis and keyword-based filtering implemented by the validator.\nThe attack flow follows these steps: 1) The attacker creates a malicious webhook template containing obfuscated computed member expressions. 2) The js-runtime validator parses the template but fails to detect the forbidden access due to the obfuscated nature of the property lookup. 3) The malicious template is registered and subsequently triggered by a webhook event. 4) Upon execution, the JavaScript engine resolves the computed property, gaining access to the Function constructor or other sensitive globals that were intended to be sandboxed. 5) The attacker executes arbitrary JavaScript code, which runs with the context and privileges of the worker process handling the webhook.\nThis vulnerability is particularly dangerous because it allows for full sandbox escape. Once the attacker gains the ability to instantiate a new Function, they can effectively bypass the restricted environment. The impact extends to potential command execution, internal network reconnaissance from the worker process, or data exfiltration, depending on the environment configuration and the permissions assigned to the worker process. The lack of robust property access control enables an attacker to manipulate the scope chain and break out of the predefined execution boundary, leading to complete compromise of the worker's execution context."
}