What is the CVSS score of CVE-2026-27574?

CVE-2026-27574 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Node.js are affected by CVE-2026-27574?

A critical vulnerability (CVSS 9.9) in OneUptime monitoring infrastructure could allow attackers to gain complete control of affected systems and the services they monitor.. A patch is available.

Is there a public PoC exploit available for CVE-2026-27574?

Yes, a public proof-of-concept exploit is available for CVE-2026-27574. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-27574?

Within 24 hours: Inventory all OneUptime instances and assess exposure; isolate critical instances if patching cannot be completed immediately. Within 7 days: Apply available vendor patch to all OneUptime deployments in production and non-production environments. Within 30 days: Complete post-patch validation, verify monitoring functionality, and document remediation in change management records.

Node.js CVE-2026-27574

CRITICAL

Code Injection (CWE-94)

2026-02-21 security-advisories@github.com

GHSA-v264-xqh4-9xmm

Node.js Redis Oneuptime

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Feb 23, 2026 - 20:36 vuln.today

Public exploit code

Patch released

Feb 23, 2026 - 20:36 nvd

Patch available

CVE Published

Feb 21, 2026 - 11:15 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, allowing trivial sandbox escape via a well-known one-liner that grants full access to the underlying process. Because the probe runs with host networking and holds all cluster credentials (ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, CLICKHOUSE_PASSWORD) in its environment variables, and monitor creation is available to the lowest role (ProjectMember) with open registration enabled by default, any anonymous user can achieve full cluster compromise in about 30 seconds. This issue has been fixed in version 10.0.5.

Articles & Coverage 1

POC CVE-2026-27574: OneUptime RCE via JavaScript Code Injection in Probes Feb 21, 2026

AnalysisAI

Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.

Technical ContextAI

CWE-94 using Node.js vm module (not sandboxed).

RemediationAI

Update OneUptime.

More in Node.js

View all

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2015-5688 MEDIUM This Month POC

5.0 Sep 04

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read

CVE-2026-45321 CRITICAL Act Now POC

9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio

CVE-2014-7192 CRITICAL Act Now POC

10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat

CVE-2013-4450 MEDIUM This Month POC

5.0 Oct 21

The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se

Same weakness CWE-94 – Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2012-0158 HIGH POC

8.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2013-3906 HIGH POC

7.8

CVE-2017-9822 HIGH POC

8.8

CVE-2018-1273 CRITICAL POC

9.8

CVE-2025-32432 CRITICAL POC

10.0

CVE-2026-27574 vulnerability details – vuln.today

Back

Node.js CVE-2026-27574

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

More in Node.js

Same weakness CWE-94 – Code Injection

Share

External POC / Exploit Code