CVE-2026-85610

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-85610

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85610.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-85610

Aliases

GHSA-7476-c5cc-8999

Published

2026-09-04T11:30:06Z

Modified

2026-10-03T03:46:59Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenPanel before 2.3.0 Remote Code Execution via chart formulas

Details

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to load Node.js built-ins and execute operating system commands with the privileges of the API process, bypassing organization authorization boundaries.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85610.json"
}

References

Affected packages

Git / github.com/openpanel-dev/openpanel

Affected ranges

Type

GIT

Repo

https://github.com/openpanel-dev/openpanel

Events

Introduced

Fixed

cd24bb838301df1a9087e2e132b344e5b8a99963

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85610.json"