Patterns
Give every item in this list the same fields
Decide the fields first. A blank that means unknown must not look like zero.
cve.org published this account (2026-09-19): CVE-2026-93985 and opened GHSA-6f7h-cvp6-w9w5 describe a critical sandbox escape in OpenPanel js-runtime through commit bad75bdd. Project writers can use computed constructor access in webhook JS templates to reach Function and run code in the worker. Opened GHSA listed patched versions as none.
This guide uses that public page as the example. This site did not run the test, close the deal, or measure the product.
Write only what the page says
The page's claim is: CVE-2026-93985 and opened GHSA-6f7h-cvp6-w9w5 describe a critical sandbox escape in OpenPanel js-runtime through commit bad75bdd. Project writers can use computed constructor access in webhook JS templates to reach Function and run code in the worker. Opened GHSA listed patched versions as none.
Put the URL under that sentence. If a later recap adds a number or a date, keep the original page as the record.
Decide the fields first. A blank that means unknown must not look like zero.
Do the site's check on this one page. Fill a line only when the page supports it. Where the page is silent, write Not stated.
A finished note names the page, the date, and the limit of the claim. It does not borrow a result from a different story.
Stop at the untested line
Anything you did not open, install, or count stays untested. Leave that line visible.
Source page: CVE-2026-93985 OpenPanel js-runtime webhook template sandbox escape, no shipped patch confirmed.
Sources: CVE-2026-93985 OpenPanel js-runtime webhook template sandbox escape, no shipped patch confirmed