medium4.3
CVE-2026-116815
OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string li…
Impact
OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHouse parse errors that disable the project's Sankey chart endpoint.
Affected products
| Product | Affected versions |
|---|---|
| OpenPanel | before 3.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.