CVE-2026-85610CWE-94code-injection

CVE-2026-85610

High · published September 4, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to load Node.js built-ins and execute operating system commands with the privileges of the API process, bypassing organization authorization boundaries.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00707 · 52.9th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-04T16:17Z
References (2)
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7476-c5cc-8999 · [email protected]https://www.vulncheck.com/advisories/openpanel-before-2.3.0-remote-code-execution-via-chart-formulas · [email protected]
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 11:30Z
    OpenPanel before 2.3.0 Remote Code Execution via chart formulas
    cvelistv5