An authenticated remote code execution vulnerability in OpenPanel versions prior to 2.3.0 permits attackers to execute arbitrary system commands with API process privileges.

This vulnerability, categorized as CWE-94, stems from improper validation of chart formula expressions. Authenticated project members with read access can exploit the mathjs matrix objects to recover the JavaScript Function constructor, which subsequently allows for the execution of arbitrary Node.js code and system commands.

The ability to execute arbitrary code with the privileges of the API process represents a severe security risk, potentially leading to a full compromise of the hosting environment. Given the CVSS score of 8.8, this high-severity flaw could facilitate unauthorized data access, lateral movement within the infrastructure, and the total loss of system integrity.

Immediate Action: Upgrade all instances of OpenPanel to version 2.3.0 or later to ensure the vulnerable formula validation logic is replaced.

Proactive Monitoring: Review API logs for unusual activity, specifically looking for attempts to inject JavaScript syntax or unexpected calls to system-level libraries via the chart interface.

Compensating Controls: Implement strict network segmentation to limit the blast radius of the API process and ensure that the application runs with the least privilege necessary for its function.

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available at this time.

The high CVSS score of 8.8 underscores the critical nature of this vulnerability. Administrators should prioritize patching to version 2.3.0 immediately, as this update remediates the underlying code injection flaw. Failure to act leaves the environment susceptible to potential remote code execution by any user with project read access.