OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
- Severity:
- High
Description
OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By leveraging a standard prototype-chain escape (this.constructor.constructor), an attacker can bypass the sandbox, gain access to the underlying Node.js process object, and execute arbitrary system commands (RCE) on the oneuptime-probe container.
Recommendation
Update the @oneuptime/common package to the latest compatible version. Followings are version details:
- Affected version(s): < 10.0.18
- Patched version(s): 10.0.18
References
Related Issues
- OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE - CVE-2026-27574
- OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding - CVE-2026-30920
- OneUptime has Synthetic Monitor RCE via exposed Playwright browser object - CVE-2026-30957
- OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() - CVE-2026-27728
You might also like:
- Tags:
- npm
- @oneuptime/common
Anything's wrong? Let us know Last updated on March 10, 2026