CVE-2026-27574: OneUptime code injection in VM sandbox allows RCE

CVE-2026-27574 · Severity: low · CVSS 3.1 · Published 2026-02-24

OneUptime is an open-source monitoring and uptime platform that allows project members to write custom JavaScript code to run within monitors. The platform uses Node.js's built-in vm module for sandboxing, which is not designed as a security boundary. An attacker can escape this sandbox with a simple one-liner payload to achieve arbitrary code execution on the probe host. Since any registered user has ProjectMember permissions and signup is open by default, this can be exploited by anyone to steal cluster credentials (database passwords, API secrets) and compromise the entire OneUptime deployment.

Technologies: @oneuptime/common (npm), OneUptime. Vendors: npm, OneUptime.

Quick answers

Is CVE-2026-27574 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27574 being exploited in the wild.
How severe is CVE-2026-27574?
Low severity, with a CVSS score of 3.1, published 24 February 2026.
Which products and versions are affected?
@oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.0; OneUptime < 10.0.0.
Is there a fix for CVE-2026-27574?
Yes. @oneuptime/common (npm): upgrade to 10.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27574 attacked?
It is attacked over the network.
Am I affected by CVE-2026-27574?
Check whether you run @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @oneuptime/common (npm): upgrade to 10.0.0 or later
    npm install @oneuptime/common@10.0.0

Technical details

The vulnerability is a code injection (CWE-94) in the VMRunner.ts component where user-supplied JavaScript from the monitor's customCode field is passed directly to vm.runInContext() without any validation, AST analysis, or keyword filtering. An attacker can escape the Node.js vm module using a well-known technique (accessing this.constructor.constructor to obtain the Function constructor) to gain access to the underlying process object. The probe runs with host networking and carries critical environment variables (ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, CLICKHOUSE_PASSWORD), allowing full cluster compromise. No authentication beyond default ProjectMember role is required; since signup is enabled by default, any internet user can register, create a project, define a malicious monitor, and achieve RCE within ~60 seconds. The IsolatedVM microservice is also affected despite its name, as it calls the same vulnerable VMRunner without using the isolated-vm npm package. Patched in version 10.0.0 by replacing the vm module with isolated-vm.

Affected products

  • OneUptime OneUptime < 10.0.0

Identifiers

  • CVE-2026-27574
  • GHSA-v264-xqh4-9xmm

Timeline

  • 2026-02-24: disclosed
  • 2026-02-24: patched: version 10.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.