CVE-2026-85610: Improper Control of Generation of Code ('Code Injection') in Openpanel-dev openpanel

CVE-2026-85610 is a code injection vulnerability in OpenPanel prior to version 2.3.0. The vulnerability arises from insufficient validation of chart formula expressions, enabling authenticated users with read access to recover the native JavaScript Function constructor through mathjs matrix objects. Exploiting this, attackers can load Node.js built-in modules and execute arbitrary OS commands with the privileges of the API process, effectively bypassing organization-level authorization controls.

Successful exploitation allows authenticated project members with read access to execute arbitrary code on the server hosting the OpenPanel API process. This can lead to unauthorized command execution at the operating system level, potentially compromising the confidentiality, integrity, and availability of the affected system and data. The vulnerability bypasses organization authorization boundaries, increasing the risk of privilege escalation within the environment.

A fix is available in OpenPanel version 2.3.0 and later. Users should upgrade to version 2.3.0 or newer to remediate this vulnerability. Until upgrading, restrict project member access to trusted users only, as exploitation requires authenticated read access. Monitor vendor advisories for any additional guidance.