EUVD-2026-32632CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API was not designed for that and can be escaped via error objects and infinite recursion. This vulnerability is fixed in 10.0.98.
AnalysisAI
Sandbox escape in OneUptime before 10.0.98 lets an authenticated user break out of the Node.js vm-module isolation that the platform relies on to safely run untrusted logic, gaining code execution in the host context. The vm module was never intended as a security boundary and can be escaped using error objects and infinite recursion, yielding full confidentiality, integrity, and availability impact (CVSS 9.9, scope-changed). …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Identify all OneUptime deployments running versions before 10.0.98; disable untrusted code execution features if available. 7 days: Restrict OneUptime access to trusted administrators; implement network isolation around all instances to prevent lateral movement. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today