What is the CVSS score of CVE-2026-30957?

CVE-2026-30957 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oneuptime are affected by CVE-2026-30957?

A critical vulnerability in OneUptime Synthetic Monitors (CVE-2026-30957) allows authenticated users with low privileges to execute arbitrary commands on probe servers, potentially compromising…. A patch is available.

Is there a public PoC exploit available for CVE-2026-30957?

Yes, a public proof-of-concept exploit is available for CVE-2026-30957. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-30957?

Within 24 hours: Inventory all OneUptime deployments and identify which versions are in use; disable Synthetic Monitors feature if operationally feasible and restrict access to the OneUptime platform to essential personnel only. Within 7 days: Implement network segmentation to isolate OneUptime probe servers from critical systems; apply restrictive RBAC to limit low-privileged user access to monitoring functions; deploy WAF rules to monitor and block suspicious command injection patterns. Within 30 days: Upgrade to OneUptime 10.0.21 or later when patch becomes available; conduct forensic review of probe server logs for signs of exploitation; reset credentials for all OneUptime service accounts.

Oneuptime CVE-2026-30957

CRITICAL

Exposed Dangerous Method or Function (CWE-749)

2026-03-10 security-advisories@github.com

GHSA-jw8q-gjvg-8w4q

RCE Oneuptime

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 12, 2026 - 14:11 vuln.today

Public exploit code

CVE Published

Mar 10, 2026 - 18:18 nvd

CRITICAL 9.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on @oneuptime/common (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 10.0.21.

DescriptionGitHub Advisory

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container. The root cause is that untrusted Synthetic Monitor code is executed inside Node's vm while live host-realm Playwright browser and page objects are exposed to it. A malicious user can call Playwright APIs on the injected browser object and cause the probe to spawn an attacker-controlled executable. This is a server-side remote code execution issue. It does not require a separate vm sandbox escape. This vulnerability is fixed in 10.0.21.