What is the CVSS score of CVE-2026-45102?

CVE-2026-45102 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of OneUptime are affected by CVE-2026-45102?

OneUptime versions before 10.0.98 can be compromised by authenticated users through a documented sandbox escape vulnerability allowing arbitrary code execution on the host system.. A patch is available.

How to fix or mitigate CVE-2026-45102?

24 hours: Identify all OneUptime deployments running versions before 10.0.98; disable untrusted code execution features if available. 7 days: Restrict OneUptime access to trusted administrators; implement network isolation around all instances to prevent lateral movement. 30 days: Monitor vendor advisories for patch release; prepare and execute upgrade to OneUptime 10.0.98 or later when available.

OneUptime CVE-2026-45102

EUVD-2026-32632 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-05-27 GitHub_M

Node.js Information Disclosure

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 27, 2026 - 21:04 EUVD

Analysis Generated

May 27, 2026 - 20:18 vuln.today

DescriptionGitHub Advisory

OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API was not designed for that and can be escaped via error objects and infinite recursion. This vulnerability is fixed in 10.0.98.

AnalysisAI

Sandbox escape in OneUptime before 10.0.98 lets an authenticated user break out of the Node.js vm-module isolation that the platform relies on to safely run untrusted logic, gaining code execution in the host context. The vm module was never intended as a security boundary and can be escaped using error objects and infinite recursion, yielding full confidentiality, integrity, and availability impact (CVSS 9.9, scope-changed). No public exploit is identified at time of analysis, but the escape technique is well-documented for the Node.js vm module generally.

Technical ContextAI

OneUptime is an open-source monitoring and observability platform that, like many automation/monitoring tools, executes user-supplied or workflow logic inside Node.js' built-in vm module to isolate it from the host process. The Node.js documentation explicitly warns that the vm module is NOT a security sandbox: it creates a separate V8 context but shares the same process and object prototypes, so references to host objects (commonly reachable through thrown error objects, prototype chains, or constructor traversal) can be used to reach the host's global scope and the require/process primitives. Triggering infinite recursion to surface a RangeError and then walking the error object's prototype/constructor chain is a classic escape path. The CWE-693 classification (Protection Mechanism Failure) is accurate: the root cause is not a parsing or memory bug but reliance on an isolation primitive that does not actually provide the intended security guarantee. Affected builds are identified by cpe:2.3:a:oneuptime:oneuptime:*:*:*:*:*:*:*:* for all versions prior to 10.0.98.

RemediationAI

Vendor-released patch: 10.0.98 - upgrade OneUptime to 10.0.98 or later, which replaces or hardens the vm-module isolation, per the advisory at https://github.com/OneUptime/oneuptime/security/advisories/GHSA-g9cp-35m2-fjv6. Until the upgrade can be applied, restrict who can author or submit code/expressions to any feature evaluated via the vm module and tighten account provisioning so that only fully trusted operators hold the low-privilege accounts that can reach the vulnerable path (trade-off: reduces self-service workflow/automation capability for ordinary users). Where feasible, run the OneUptime process under a least-privilege OS account and network-segment it so a host-context escape yields minimal lateral reach (trade-off: added operational complexity, no protection against in-process data exposure). These are compensating controls only; the vm module is not a security boundary, so the upgrade is the sole reliable fix.