CyberRota Analysis
AI-GeneratedA critical sandbox escape vulnerability exists in the JavaScript webhook template validator of OpenPanel js-runtime, allowing attackers with project write access to exploit computed property notation to access the Function constructor. This enables the execution of arbitrary code within the worker process, posing a significant risk to the integrity of the application. Organizations using affected versions of Java should prioritize patching this vulnerability to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.