OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE

Description

OneUptime lets project members write custom JavaScript that runs inside monitors. The problem is it executes that code using Node.js’s built-in vm module, which Node.js itself documents as “not a security mechanism — do not use it to run untrusted code.

Recommendation

Update the @oneuptime/common package to the latest compatible version. Followings are version details:

• Affected version(s): < 10.0.0
• Patched version(s): 10.0.0

References

• GHSA-v264-xqh4-9xmm
• CVE-2026-27574
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE - CVE-2026-30887
• OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding - CVE-2026-30920
• NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node - CVE-2026-34156
• Flowise Sandbox Escape to RCE - CVE-2026-69253

You might also like:

10 Secure Coding Best Practices to Follow in Every Project

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

Tags:

npm

@oneuptime/common