Executive brief
OneUptime is an open-source monitoring and uptime platform that allows project members to write custom JavaScript code to run within monitors. The platform uses Node.js's built-in vm module for sandboxing, which is not designed as a security boundary. An attacker can escape this sandbox with a simple one-liner payload to achieve arbitrary code execution on the probe host. Since any registered user has ProjectMember permissions and signup is open by default, this can be exploited by anyone to steal cluster credentials (database passwords, API secrets) and compromise the entire OneUptime deployment.
Technical details
The vulnerability is a code injection (CWE-94) in the VMRunner.ts component where user-supplied JavaScript from the monitor's customCode field is passed directly to vm.runInContext() without any validation, AST analysis, or keyword filtering. An attacker can escape the Node.js vm module using a well-known technique (accessing this.constructor.constructor to obtain the Function constructor) to gain access to the underlying process object. The probe runs with host networking and carries critical environment variables (ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, CLICKHOUSE_PASSWORD), allowing full cluster compromise. No authentication beyond default ProjectMember role is required; since signup is enabled by default, any internet user can register, create a project, define a malicious monitor, and achieve RCE within ~60 seconds. The IsolatedVM microservice is also affected despite its name, as it calls the same vulnerable VMRunner without using the isolated-vm npm package. Patched in version 10.0.0 by replacing the vm module with isolated-vm.
Affected products
- OneUptime OneUptime < 10.0.0
Timeline
- 2026-02-24: disclosed
- 2026-02-24: patched: version 10.0.0