Oneuptime
CVE-2026-27728
CRITICAL
GHSA-jmhp-5558-qxh5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as project user
-
ExploitInject shell metacharacters into monitor destination field
-
ExecutionNetworkPathMonitor.performTraceroute() executes malicious commands
-
ImpactArbitrary code execution on Probe server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated project user account required. OneUptime version prior to 10.0.7 with NetworkPathMonitor feature enabled. Access to monitor configuration UI to modify destination field with traceroute capability active. |
| Impact | CVSS 9.9 with scope change, EPSS 0.37%. Monitoring platforms have broad network access — RCE enables pivoting to monitored infrastructure. |
| Exploit ScenarioDerived | Authenticated user injects commands through monitoring configuration, gains shell access, pivots to monitored servers using monitoring agent credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
OS command injection in OneUptime monitoring platform before 10.0.7. Authenticated users can execute arbitrary commands on the monitoring server. PoC and patch available.
Earlier versions of this analysis (1)
Command injection RCE in OneUptime monitoring platform.
RemediationAI
Update to OneUptime 10.0.7.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection. The monitoring platform passes user-controlled inputs to system commands.
Know when Oneuptime gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in NetworkPathMonitor.performTraceroute() allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into a monitor's destination field. Version 10.0.7 fixes the vulnerability.
Executive ViewAI
CVE-2026-27728 is a critical vulnerability (CVSS 9.9) affecting OneUptime monitoring infrastructure that could allow attackers to compromise service availability and monitoring capabilities. Organizations using OneUptime for infrastructure visibility face immediate risk of unauthorized access and potential service disruption, requiring urgent patching to maintain operational resilience.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)GitHub Advisory
OneUptime prior to 10.0.21 has a fourth vulnerability in Synthetic monitoring exposing dangerous functionality.
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
OneUptime monitoring platform prior to 10.0.18 allows code injection (CVSS 9.9) enabling RCE through the monitoring conf
OneUptime prior to 10.0.21 has a third authorization bypass enabling low-privileged users to access admin functions.
OneUptime prior to 10.0.20 exposes dangerous functionality in Synthetic monitoring that enables code execution.
OneUptime is a solution for monitoring and managing online services. Rated high severity (CVSS 8.8), this vulnerability
Unauthenticated path traversal in OneUptime prior to 10.0.21 lets remote attackers read arbitrary files from the server
OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by
OneUptime is a solution for monitoring and managing online services. Rated high severity (CVSS 8.3), this vulnerability
OneUptime versions 10.0.11 and earlier contain an improper WebAuthn implementation where server-side challenge validatio
OneUptime is a solution for monitoring and managing online services. Rated medium severity (CVSS 6.9), this vulnerabilit
Remote command execution can be achieved by low-privileged authenticated users (ProjectMember role) in OneUptime monitor
Exploit-DB