OneUptime Code Execution Vulnerabilities

OneUptime monitoring platform prior to 10.0.18 allows code injection (CVSS 9.9) enabling RCE through the monitoring configuration.

OneUptime prior to 10.0.20 exposes dangerous functionality in Synthetic monitoring that enables code execution.

A Siemens product has a command injection vulnerability enabling remote code execution.

OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by exploiting insufficient validation in the OAuth callback handler, enabling them to redirect repository access and create code records in arbitrary projects. Public exploit code exists for this vulnerability, and GitHub and OneUptime users remain at risk until patches are applied, as no fixes are currently available for the affected GitHub integration.