CyberRota Analysis
AI-GeneratedOpenPanel versions prior to 2.3.0 are vulnerable due to inadequate validation of chart formula expressions, enabling authenticated users with read access to execute arbitrary code. This flaw allows attackers to leverage the native JavaScript Function constructor to load Node.js built-ins and execute OS commands, potentially compromising the API process's privileges and bypassing organizational security measures. Organizations using affected versions of OpenPanel should prioritize patching this vulnerability to mitigate the risk of unauthorized code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to load Node.js built-ins and execute operating system commands with the privileges of the API process, bypassing organization authorization boundaries.