OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

Description

An OS command injection vulnerability in NetworkPathMonitor.performTraceroute() allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into a monitor’s destination field.

Recommendation

Update the @oneuptime/common package to the latest compatible version. Followings are version details:

• Affected version(s): < 10.0.7
• Patched version(s): 10.0.7

References

• GHSA-jmhp-5558-qxh5
• CVE-2026-27728
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• OneUptime ClickHouse SQL Injection via Aggregate Query Parameters - CVE-2026-32306
• OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts - CVE-2026-48054
• Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream - CVE-2026-42037
• OneUptime has Synthetic Monitor RCE via exposed Playwright browser object - CVE-2026-30957

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@oneuptime/common