Oneuptime EUVD-2026-16189

Requires authenticated access as ProjectMember role in OneUptime versions prior to 10.0.35. Attacker must create or modify a Synthetic Monitor with malicious Playwright script code exploiting unblocked _browserType and launchServer properties to execute arbitrary commands on the Probe container.

This represents a critical real-world risk based on multiple converging signals. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates network-accessible exploitation with low complexity, requiring only low-privileged authenticated access, no user interaction, and resulting in complete confidentiality, integrity, and availability compromise with scope change beyond the vulnerable component. SSVC framework assessment confirms proof-of-concept exploit availability, non-automatable exploitation, and total technical impact. While the vulnerability requires authenticated ProjectMember credentials (PR:L), the attack complexity is low and a POC exists, significantly lowering the exploitation barrier. No CISA KEV listing indicates no confirmed active exploitation at time of analysis, but the combination of critical CVSS score, POC availability, and the prevalence of monitoring platforms in production environments makes this a high-priority patching target. The scope change (S:C) is particularly concerning as compromise of the monitoring infrastructure could provide lateral movement opportunities across monitored systems.

A malicious insider or compromised ProjectMember account holder creates a synthetic monitor with a Playwright script containing code that traverses page.context().browser()._browserType.launchServer() to spawn a reverse shell or execute arbitrary commands on the Probe container host. The attacker leverages network access (AV:N) with low complexity (AC:L) and no user interaction required (UI:N), achieving complete system compromise. Publicly available exploit code exists per SSVC framework data, lowering the technical barrier for exploitation and enabling rapid weaponization by threat actors with access to low-privileged credentials.