OneUptime has Synthetic Monitor RCE via exposed Playwright browser object

Description

OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container.

The root cause is that untrusted Synthetic Monitor code is executed inside Node’s vm while live host-realm Playwright browser and page objects are exposed to it.

Recommendation

Update the @oneuptime/common package to the latest compatible version. Followings are version details:

• Affected version(s): < 10.0.21
• Patched version(s): 10.0.21

References

• GHSA-jw8q-gjvg-8w4q
• CVE-2026-30957
• CWE-749
• CAPEC-310
• OWASP 2021-A6

Related Issues

• OneUptime: Synthetic Monitor RCE via exposed Playwright browser object - CVE-2026-30921
• OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data ex - CVE-2026-30956
• jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method - CVE-2026-25755
• OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing cre - CVE-2026-28787

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@oneuptime/common