CVE-2026-85610 in OpenPanel
Summary
by MITRE • 09/04/2026
OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to load Node.js built-ins and execute operating system commands with the privileges of the API process, bypassing organization authorization boundaries.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in OpenPanel versions prior to 2.3.0 represents a critical server-side code execution flaw rooted in improper input validation within its chart formula engine. The core technical issue stems from the application's reliance on the mathjs library for processing mathematical expressions submitted by users. While mathjs is designed primarily for safe numerical computation, it contains internal mechanisms that allow access to JavaScript constructors under specific conditions involving matrix objects. In this context, authenticated project members who possess read-only permissions were able to exploit a logic flaw in how these formulas are parsed and evaluated. By crafting malicious chart formula expressions, an attacker can manipulate the evaluation process to recover the native JavaScript Function constructor from within mathjs matrix structures. This recovery bypasses standard sandboxing or restriction mechanisms that would normally prevent direct access to powerful language features.
Once the Function constructor is recovered, it serves as a gateway for loading Node.js built-in modules such as child_process and fs. These modules provide low-level access to the operating system's command interpreter and file system respectively. Consequently, an attacker can construct expressions that instantiate these modules and execute arbitrary shell commands directly on the host server. The severity of this vulnerability is significantly amplified by the fact that it requires only read access rather than administrative privileges. This means that any user within a project organization, regardless of their intended role or permission level, can escalate their capabilities to full system control. The attack effectively bypasses organizational authorization boundaries, allowing lateral movement and complete compromise of the underlying infrastructure hosting the OpenPanel instance.
From an operational impact perspective, this vulnerability enables remote code execution with the privileges of the API process running OpenPanel. If the service is configured to run as a privileged user or root, which is common in some containerized or virtualized deployments for ease of configuration, the attacker gains full control over the host system. This can lead to data exfiltration, installation of persistent backdoors, pivoting to other internal services, and disruption of availability through resource exhaustion or destructive file operations. The ability to execute commands as the API process also means that any environment variables, secrets, or credentials accessible to that process are potentially exposed to the attacker. This undermines the fundamental security principle of least privilege, as read-only users effectively obtain write-execute privileges at the operating system level.
The technical classification of this flaw aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically where user input influences code execution through a library's internal evaluation engine rather than direct injection into source files. Furthermore, in terms of adversary tactics and techniques, this vulnerability maps to ATT&CK technique T1059 Command and Scripting Interpreter, as it allows the use of system shells for command execution. It also relates to T1621 API Abuse, where legitimate APIs are manipulated to perform unauthorized actions due to insufficient validation of input parameters. The exploitation path demonstrates how complex libraries can introduce unexpected attack surfaces if their internal object structures are not properly isolated from user-controlled data flows during evaluation phases.
Mitigation strategies must prioritize immediate patching to version 2.3.0 or later, where the developers have addressed the improper validation of chart formula expressions and restricted access to dangerous JavaScript constructors within mathjs objects. In environments where upgrading is not immediately feasible, network-level controls should be implemented to restrict outbound connections from the OpenPanel server that could facilitate command-and-control communications if exploitation occurs. Additionally, running the API process with minimal privileges using principles like least privilege can limit the blast radius of such an exploit. Input validation at the application layer should also be reviewed to ensure that all formula inputs are sanitized against known malicious patterns before being passed to evaluation engines. Regular security audits focusing on third-party library usage and their interaction with user input are essential for preventing similar code injection vulnerabilities in web applications relying on dynamic expression evaluators.