CVE-2026-27728: OneUptime Probe OS command injection in NetworkPathMonitor

CVE-2026-27728 · Severity: low · CVSS 3.1 · Published 2026-02-25

OneUptime is an open-source monitoring and observability platform that uses Probe servers to perform network diagnostics like traceroute. An authenticated user can inject shell commands into the destination field of a network path monitor, causing the Probe server to execute arbitrary operating system commands with the privileges of the monitoring service. This allows attackers to read sensitive files, steal credentials, and potentially compromise other monitoring tenants or internal infrastructure.

Technologies: @oneuptime/common (npm), OneUptime. Vendors: npm, OneUptime.

Quick answers

Is CVE-2026-27728 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27728 being exploited in the wild.
How severe is CVE-2026-27728?
Low severity, with a CVSS score of 3.1, published 25 February 2026.
Which products and versions are affected?
@oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.7; OneUptime <= 10.0.6.
Is there a fix for CVE-2026-27728?
Yes. @oneuptime/common (npm): upgrade to 10.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27728 attacked?
It is attacked over the network.
Am I affected by CVE-2026-27728?
Check whether you run @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @oneuptime/common (npm): upgrade to 10.0.7 or later
    npm install @oneuptime/common@10.0.7

Technical details

The vulnerability is an OS command injection (CWE-78) in NetworkPathMonitor.performTraceroute() (lines 149–191 of Probe/Utils/Monitors/MonitorTypes/NetworkPathMonitor.ts). The destination parameter is directly interpolated into a shell command string without sanitization, then executed via child_process.exec(). Since exec() spawns a shell (/bin/sh), shell metacharacters (;, |, $(), ``, &&, ||, \n) in the destination are interpreted as commands. An authenticated project user can craft a payload like "127.0.0.1; id" or "127.0.0.1 | whoami" and execute arbitrary commands on the Probe server. The vulnerability requires authentication and project-level access, but no special privileges are needed beyond creating or editing a network path monitor. No patch has been released as of 2026-02-28.

Affected products

  • OneUptime oneuptime <= 10.0.6

Identifiers

  • CVE-2026-27728
  • GHSA-jmhp-5558-qxh5

Timeline

  • 2026-02-25: disclosed: Advisory published on GitHub and OSV
  • 2026-02-28: other: No patch released as of latest advisory update

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.