OpenPanel js-runtime Sandbox Escape via Webhook Template Constructor Chain

Technical Analysis

The vulnerability resides in the JavaScript webhook template validator, which fails to properly restrict computed member access (e.g., obj['constructor']['constructor']) that can traverse to the global Function constructor, bypassing the sandbox's intended restrictions on code execution. An attacker with project write access can craft a webhook template using bracket notation to dynamically resolve constructor chains, ultimately calling Function() to execute arbitrary JavaScript in the worker process context. This is a classic JS sandbox escape pattern common in restricted-eval implementations (vm2-style escapes), where property-name filtering is insufficient against dynamic/computed access. With a CVSS of 9.9, the flaw likely permits full compromise of the worker process, including host-level access if the worker runs with elevated privileges or has network/filesystem access. If OpenPanel's js-runtime or similar sandboxed webhook/template execution engines are used by AI agent frameworks or automation pipelines to process untrusted templates, tool-call outputs, or webhook payloads, this vulnerability could allow an attacker to escape the sandbox and execute arbitrary code within the agent's execution environment, potentially exfiltrating API keys or pivoting to other agent-connected systems.

Affected Systems

OpenPanel js-runtime through commit bad75bdd; any deployment using the webhook template validator feature for custom JavaScript webhook templates; worker processes executing user-defined webhook templates

Indicators of Compromise

• No specific IOCs published; exploitation indicators may include webhook templates containing bracket/computed property notation referencing 'constructor', anomalous Function() calls in worker process logs, unexpected child processes spawned from js-runtime worker

Remediation Steps

1. 1

   Patch to fixed version

   Upgrade OpenPanel js-runtime to a version beyond commit bad75bdd once a patch is released; monitor OpenPanel's advisory channels for the fix.

2. 2

   Restrict webhook template write access

   Limit project write access and webhook template creation permissions to trusted, vetted users only until patched.

3. 3

   Deploy input validation on templates

   Implement additional filtering to block bracket/computed property access patterns targeting 'constructor', 'prototype', and similar reflective properties in webhook templates.

4. 4

   Isolate worker processes

   Run js-runtime worker processes in hardened containers or VMs with minimal privileges, no network egress, and no access to sensitive credentials or agent API keys.

5. 5

   Audit existing webhook templates

   Review all currently deployed webhook templates for suspicious computed property access or constructor chain patterns indicating exploitation attempts.

6. 6

   Rotate exposed credentials

   If worker processes had access to API keys, tokens, or secrets used by connected agent or automation systems, rotate them as a precaution.