OneUptime: Synthetic Monitor RCE via exposed Playwright browser object

Description

Summary

OneUptime Synthetic Monitors allow low-privileged project users to submit custom Playwright code that is executed on the oneuptime-probe service. In the current implementation, this untrusted code is run inside Node’s vm and is given live host Playwright objects such as browser and page.

Recommendation

Update the @oneuptime/common package to the latest compatible version. Followings are version details:

• Affected version(s): < 10.0.20
• Patched version(s): 10.0.20

References

• GHSA-4j36-39gm-8vq8
• CVE-2026-30921
• CWE-749
• CAPEC-310
• OWASP 2021-A6

Related Issues

• OneUptime has Synthetic Monitor RCE via exposed Playwright browser object - CVE-2026-30957
• OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE - CVE-2026-27574
• OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data ex - CVE-2026-30956
• OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE - CVE-2026-30887

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@oneuptime/common