CVE-2026-85610 OpenPanel before 2.3.0 Remote Code Execution via chart formulas

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...

CVE-2026-85610

OpenPanel before version 2.3.0 is vulnerable to Remote Code Execution via chart formula expressions. The root cause is improper validation of these expressions, which allows authenticated project members with read access to recover the native JavaScript Function constructor through mathjs matrix ...

CVE-2026-85610 OpenPanel before 2.3.0 Remote Code Execution via chart formulas

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...