Oneuptime
CVE-2026-30921
CRITICAL
GHSA-4j36-39gm-8vq8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged project user
-
ExploitSubmit malicious Playwright code to Synthetic Monitor
-
ExecutionExecute arbitrary code via injected browser object
-
ImpactCompromise oneuptime-probe service and beyond
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Dangerous method exposure prevention
|
| Exploitation Conditions | Low-privileged project user account with access to OneUptime Synthetic Monitors feature. Custom Playwright code execution capability must be enabled in the probe service. OneUptime versions prior to 10.0.20. |
| Impact | CVSS 9.9 with PoC. Second OneUptime vulnerability. |
| Exploit ScenarioDerived | An attacker uses the exposed synthetic monitoring functionality to execute arbitrary code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
OneUptime prior to 10.0.20 exposes dangerous functionality in Synthetic monitoring that enables code execution.
Earlier versions of this analysis (1)
Exposed dangerous functionality in OneUptime Synthetic monitoring enables RCE.
RemediationAI
Update OneUptime.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OneUptime < 10.0.20 has a CWE-749 exposed dangerous method in Synthetic monitoring.
Know when Oneuptime gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.20, OneUptime Synthetic Monitors allow low-privileged project users to submit custom Playwright code that is executed on the oneuptime-probe service. In the current implementation, this untrusted code is run inside Node's vm and is given live host Playwright objects such as browser and page. This creates a distinct server-side RCE primitive: the attacker does not need the classic this.constructor.constructor(...) sandbox escape. Instead, the attacker can directly use the injected Playwright browser object to reach browser.browserType().launch(...) and spawn an arbitrary executable on the probe host/container. This vulnerability is fixed in 10.0.20.
Blast Radius
ecosystem impact- 1 npm packages depend on @oneuptime/common (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 10.0.20.
Executive ViewAI
OneUptime Synthetic Monitors contain a critical remote code execution vulnerability (CVSS 9.9) that allows low-privileged users to execute arbitrary code on monitoring infrastructure. Organizations using OneUptime versions prior to 10.0.20 face immediate risk of system compromise, data breach, and operational disruption through the probe service.
Disable custom Playwright code submission in synthetic monitors until patch available; implement WAF rules to block synthetic monitor API endpoints from untrusted sources; segment probe services on isolated network with restricted egress; restrict OneUptime user roles to prevent project-level synthetic monitor creation; require administrative approval for any custom monitor code; monitor and log all Playwright code execution attempts; implement file integrity monitoring on probe service executables.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in OneUptime Code Execution Vulnerabilities
View all 4OS command injection in OneUptime monitoring platform before 10.0.7. Authenticated users can execute arbitrary commands
OneUptime prior to 10.0.21 has a fourth vulnerability in Synthetic monitoring exposing dangerous functionality.
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
OneUptime prior to 10.0.21 has a third authorization bypass enabling low-privileged users to access admin functions.
OneUptime is a solution for monitoring and managing online services. Rated high severity (CVSS 8.8), this vulnerability
Unauthenticated path traversal in OneUptime prior to 10.0.21 lets remote attackers read arbitrary files from the server
OneUptime is a solution for monitoring and managing online services. Rated high severity (CVSS 8.3), this vulnerability
OneUptime versions 10.0.11 and earlier contain an improper WebAuthn implementation where server-side challenge validatio
OneUptime is a solution for monitoring and managing online services. Rated medium severity (CVSS 6.9), this vulnerabilit
Remote command execution can be achieved by low-privileged authenticated users (ProjectMember role) in OneUptime monitor
Exploit-DB