Summary
OpenPanel contains a sandbox escape in its JavaScript runtime validator that can allow project members with write access to bypass the intended AST allowlist. Under those conditions, an attacker may execute arbitrary code in the worker process.
OpenPanel contains a sandbox escape in its JavaScript runtime validator that can allow project members with write access to bypass the intended AST allowlist. Under those conditions, an attacker may execute arbitrary code in the worker process.
Affected context
The issue occurs in OpenPanel projects that process member-controlled JavaScript through the js-runtime validator. Risk increases when project members can submit or modify code, the validator relies on an incomplete AST allowlist, and the worker process exposes meaningful application or host permissions.
The issue occurs in OpenPanel projects that process member-controlled JavaScript through the js-runtime validator. Risk increases when project members can submit or modify code, the validator relies on an incomplete AST allowlist, and the worker process exposes meaningful application or host permissions.
Exploit preconditions
- Attack surface: The OpenPanel JavaScript runtime validator
- Required access: Write access to a project or another ability to submit JavaScript for validation
- Trigger point: Evaluation of attacker-controlled code in the worker process
- Why exploitation is possible: The validator can be bypassed through indirect access to a restricted function-construction capability, allowing code to execute outside the intended sandbox
- Attack surface: The OpenPanel JavaScript runtime validator
- Required access: Write access to a project or another ability to submit JavaScript for validation
- Trigger point: Evaluation of attacker-controlled code in the worker process
- Why exploitation is possible: The validator can be bypassed through indirect access to a restricted function-construction capability, allowing code to execute outside the intended sandbox
Why this happens
The vulnerability results from an incomplete sandbox policy that validates syntax or AST structure without fully constraining JavaScript runtime capabilities. By permitting aliases or indirect references to powerful built-in constructors, the validator fails to prevent access to dynamic code execution. This behavior maps to CWE-94: Improper Control of Generation of Code, because attacker-controlled input can reach a code-generation or execution capability.
The vulnerability results from an incomplete sandbox policy that validates syntax or AST structure without fully constraining JavaScript runtime capabilities. By permitting aliases or indirect references to powerful built-in constructors, the validator fails to prevent access to dynamic code execution. This behavior maps to CWE-94: Improper Control of Generation of Code, because attacker-controlled input can reach a code-generation or execution capability.
Potential impact
- Arbitrary code execution in the worker process
- Escape from the intended JavaScript sandbox
- Access to process environment data and application secrets
- Modification or destruction of project-related data
- Potential lateral movement depending on worker permissions and network access
- Arbitrary code execution in the worker process
- Escape from the intended JavaScript sandbox
- Access to process environment data and application secrets
- Modification or destruction of project-related data
- Potential lateral movement depending on worker permissions and network access
General mitigation guidance
Mitigation generally focuses on reducing the capabilities available to untrusted JavaScript rather than relying only on syntax filtering.
Common defensive patterns include:
- Using a purpose-built sandbox with strong runtime isolation and explicit capability controls
- Removing access to dynamic code-generation mechanisms and reflective constructor paths
- Applying deny-by-default policies to globals, modules, filesystem access, and network operations
- Treating project-member code as untrusted regardless of project-level write permissions
- Running worker processes with least privilege, resource limits, and isolated credentials
- Enforcing strict separation between code execution workers and sensitive control-plane services
Mitigation generally focuses on reducing the capabilities available to untrusted JavaScript rather than relying only on syntax filtering.
Common defensive patterns include:
- Using a purpose-built sandbox with strong runtime isolation and explicit capability controls
- Removing access to dynamic code-generation mechanisms and reflective constructor paths
- Applying deny-by-default policies to globals, modules, filesystem access, and network operations
- Treating project-member code as untrusted regardless of project-level write permissions
- Running worker processes with least privilege, resource limits, and isolated credentials
- Enforcing strict separation between code execution workers and sensitive control-plane services
How teams detect issues like this
Detection approaches commonly include:
- Static analysis rules for dynamic function construction, reflective property access, and sandbox escape patterns
- Code review checks for AST allowlists that validate syntax but not runtime capability reachability
- Tests that exercise aliases, indirect references, inherited properties, and other alternate access paths
- Runtime monitoring for unexpected child processes, filesystem access, network connections, or secret reads from worker processes
- Policy enforcement requiring isolated execution environments for member-supplied code
Automated security scanning and adversarial sandbox testing can help identify incomplete allowlists before deployment.
Detection approaches commonly include:
- Static analysis rules for dynamic function construction, reflective property access, and sandbox escape patterns
- Code review checks for AST allowlists that validate syntax but not runtime capability reachability
- Tests that exercise aliases, indirect references, inherited properties, and other alternate access paths
- Runtime monitoring for unexpected child processes, filesystem access, network connections, or secret reads from worker processes
- Policy enforcement requiring isolated execution environments for member-supplied code
Automated security scanning and adversarial sandbox testing can help identify incomplete allowlists before deployment.
