Description
OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By leveraging a standard prototype-chain escape (this.constructor.constructor), an attacker can bypass the sandbox, gain access to the underlying Node.js process object, and execute arbitrary system commands (RCE) on the oneuptime-probe container.
Recommendation
Update the @oneuptime/common package to the latest compatible version. Followings are version details:
- Affected version(s): < 10.0.18
- Patched version(s): 10.0.18
References
Could your website be exposed too?
SmartScanner can check your website for OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE and gives you actionable findings to investigate.
Start a free scanRelated Issues
- OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE - CVE-2026-27574
- OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding - CVE-2026-30920
- OneUptime has Synthetic Monitor RCE via exposed Playwright browser object - CVE-2026-30957
- OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() - CVE-2026-27728
You might also like:
See something that needs correcting? Let us knowUpdated March 10, 2026