A critical sandbox escape vulnerability in the OpenPanel js-runtime allows authenticated users to achieve remote code execution on the underlying worker process.

The vulnerability is a code injection flaw (CWE-94) where the JavaScript webhook template validator fails to restrict computed member access to constructor chains. Attackers with project write access can leverage this to access the Function constructor and execute arbitrary code.

A successful exploit grants the attacker the ability to execute arbitrary code within the worker process, leading to a full compromise of the application environment. Given the CVSS score of 9.9, this vulnerability poses a severe risk to data confidentiality, integrity, and system availability. Unauthorized access at this level could result in complete system takeover and potential lateral movement within the infrastructure.

Immediate Action: Review the official GitHub security advisory at https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-6f7h-cvp6-w9w5 and apply the latest available updates or patches provided by the vendor.

Proactive Monitoring: Audit application logs for unauthorized or suspicious webhook template creations, specifically monitoring for unusual use of computed property notation or attempts to invoke the Function constructor.

Compensating Controls: Restrict project write access to trusted users only and implement strict egress filtering on worker processes to limit the impact of potential command execution.

Public Exploit Available: Unknown

This vulnerability represents a critical security risk due to its potential for full remote code execution. Organizations utilizing OpenPanel should prioritize auditing user permissions to ensure that only authorized personnel have project write access. Administrators must monitor vendor channels for the release of a definitive patch and apply it immediately upon availability to neutralize this high-severity threat.