Security readout for executives and security teams
Plain-English summary
A user with project write access could escape OpenPanel's JavaScript webhook template restrictions and run arbitrary code in the worker process. This could compromise information and operations accessible to that worker. The supplied description identifies js-runtime through version 2.3.0, but provides no confirmed fixed version.
Executive priority
Prioritize prompt exposure assessment because the supplied rating is critical and successful exploitation permits worker-level code execution. If affected functionality is deployed, urgently review write access and obtain vendor remediation guidance. Business impact depends on the worker's access to sensitive data, credentials, and services; compromise is not established by this bundle.
Technical view
The JavaScript webhook template validator fails to block computed member access to constructor chains, allowing access to the Function constructor and arbitrary code execution in the worker process. The bundle classifies this as CWE-94 and assigns CVSS 3.1 9.9, with network access, low privileges, no user interaction, changed scope, and high confidentiality, integrity, and availability impacts.
Likely exposure
Potential exposure concerns deployments using OpenPanel js-runtime through 2.3.0 for JavaScript webhook templates where users have project write access. The structured affected-product entry lists version "0" and defaultStatus "unaffected", conflicting with the descriptive version range. Actual exposure requires confirmation of the deployed runtime, template functionality, and permissions.
Exploitation context
The described attack requires project write access; it is not described as unauthenticated. The bundle marks KEV as false and supplies no evidence of active exploitation or public exploit availability. Those omissions do not establish that exploitation has never occurred.
Researcher notes
Analysis uses only the supplied bundle; linked pages were not independently reviewed. No patch, fixed version, vendor workaround, or exploitation evidence is supplied. The affected-version metadata conflicts with the narrative, reducing confidence in precise product scoping. Precautionary access restrictions are risk reduction suggestions, not confirmed fixes.
Mitigation direction
- Check the referenced vendor advisory for confirmed affected versions, a fixed release, and supported mitigation guidance.
- Pending vendor guidance, restrict project write access to essential trusted users as a precaution.
- Review worker permissions and limit accessible credentials, data, and network resources to reduce potential impact.
Validation and detection
- Inventory deployed OpenPanel js-runtime versions and identify deployments using JavaScript webhook templates.
- Reconcile the descriptive affected range with the inconsistent structured version entry using vendor guidance.
- Audit project write permissions and review webhook template changes for unexpected activity.
- Review worker logs and credential use for anomalies; the bundle supplies no specific indicators of compromise.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-93985 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H3.16VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.4CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-6f7h-cvp6-w9w5)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: OpenPanel js-runtime JavaScript Template Sandbox Escape RCECVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE mapping pending import
This CVE carries a CWE mapping that will resolve to a full Glexia CWE intelligence page after the official CWE import is complete.