Oneuptime
CVE-2026-30887
CRITICAL
GHSA-h343-gg57-2q67
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as project member
-
DeliveryCreate synthetic monitor with malicious JavaScript
-
ExploitExecute prototype-chain escape via constructor.constructor
-
ExecutionAccess Node.js process object
-
ImpactExecute arbitrary system commands on probe container
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be an authenticated OneUptime project member with permission to create or modify Synthetic Monitors. The system must be running OneUptime version prior to 10.0.18 with the insecure Node.js vm module sandbox for Playwright/JavaScript code execution. |
| Impact | CVSS 9.9 with PoC. Monitoring platforms have access to all monitored services and credentials. |
| Exploit ScenarioDerived | An attacker injects code through a monitoring configuration that executes on the OneUptime server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
OneUptime monitoring platform prior to 10.0.18 allows code injection (CVSS 9.9) enabling RCE through the monitoring configuration.
Earlier versions of this analysis (1)
Code injection in OneUptime monitoring enables RCE.
RemediationAI
Update OneUptime.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OneUptime < 10.0.18 has a CWE-94 code injection in monitoring configurations. First of four OneUptime vulnerabilities.
Know when Oneuptime gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By leveraging a standard prototype-chain escape (this.constructor.constructor), an attacker can bypass the sandbox, gain access to the underlying Node.js process object, and execute arbitrary system commands (RCE) on the oneuptime-probe container. Furthermore, because the probe holds database/cluster credentials in its environment variables, this directly leads to a complete cluster compromise. This vulnerability is fixed in 10.0.18.
Blast Radius
ecosystem impact- 1 npm packages depend on @oneuptime/common (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 10.0.18.
Executive ViewAI
CVE-2026-30887 is a critical vulnerability in OneUptime versions prior to 10.0.18 that allows project members to execute arbitrary code through Synthetic Monitors, potentially compromising your infrastructure and sensitive data. This poses an immediate risk to any organization using OneUptime for monitoring, as attackers with project access can escalate privileges and gain control of your systems.
Disable custom Playwright/JavaScript execution in Synthetic Monitors immediately if feature is not critical to operations; implement strict network segmentation restricting OneUptime outbound connections to whitelisted endpoints only; enforce multi-factor authentication for all OneUptime project members; implement Web Application Firewall rules to monitor and block suspicious code patterns in Synthetic Monitor submissions; conduct continuous monitoring of OneUptime audit logs for suspicious activity; consider temporary suspension of Synthetic Monitor functionality until patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in OneUptime Code Execution Vulnerabilities
View all 4OS command injection in OneUptime monitoring platform before 10.0.7. Authenticated users can execute arbitrary commands
OneUptime prior to 10.0.21 has a fourth vulnerability in Synthetic monitoring exposing dangerous functionality.
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
OneUptime prior to 10.0.21 has a third authorization bypass enabling low-privileged users to access admin functions.
OneUptime is a solution for monitoring and managing online services. Rated high severity (CVSS 8.8), this vulnerability
Unauthenticated path traversal in OneUptime prior to 10.0.21 lets remote attackers read arbitrary files from the server
OneUptime is a solution for monitoring and managing online services. Rated high severity (CVSS 8.3), this vulnerability
OneUptime versions 10.0.11 and earlier contain an improper WebAuthn implementation where server-side challenge validatio
OneUptime is a solution for monitoring and managing online services. Rated medium severity (CVSS 6.9), this vulnerabilit
Remote command execution can be achieved by low-privileged authenticated users (ProjectMember role) in OneUptime monitor
Exploit-DB