Is CVE-2026-30887 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30887 being exploited in the wild.

How severe is CVE-2026-30887?

Low severity, with a CVSS score of 3.1, published 7 March 2026.

Which products and versions are affected?

@oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.18; OneUptime < 10.0.18.

Is there a fix for CVE-2026-30887?

Yes. @oneuptime/common (npm): upgrade to 10.0.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30887 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-30887?

Check whether you run @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30887: OneUpTime unsandboxed code execution in Probe allowing RCE

Q: Is there a fix for CVE-2026-30887?

Yes. @oneuptime/common (npm): upgrade to 10.0.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-30887 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-30887?

Check whether you run @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30887 · Severity: low · CVSS 3.1 · Published 2026-03-07

OneUpTime is an open-source monitoring platform that allows project members to write custom JavaScript/Playwright code within Synthetic Monitors to test websites. A critical sandbox escape vulnerability in the Node.js vm module execution allows any project member to bypass the sandbox, execute arbitrary system commands on the probe container, and access sensitive environment variables containing database credentials, resulting in complete cluster compromise.

Technologies: @oneuptime/common (npm), OneUptime. Vendors: npm, OneUptime.

Quick answers

Is CVE-2026-30887 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30887 being exploited in the wild.
How severe is CVE-2026-30887?: Low severity, with a CVSS score of 3.1, published 7 March 2026.
Which products and versions are affected?: @oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.18; OneUptime < 10.0.18.
Is there a fix for CVE-2026-30887?: Yes. @oneuptime/common (npm): upgrade to 10.0.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30887 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-30887?: Check whether you run @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@oneuptime/common (npm): upgrade to 10.0.18 or later
```
npm install @oneuptime/common@10.0.18
```

Technical details

The vulnerability exists in Common/Server/Utils/VM/VMRunner.ts where user-supplied JavaScript is executed using vm.runInContext() without any AST filtering or secure isolation. An attacker with Project Member privileges can use a prototype-chain escape payload (this.constructor.constructor('return process')()) to bypass the sandbox, gain access to the underlying Node.js process object, and execute arbitrary shell commands via the child_process module. Since the oneuptime-probe service runs with access to sensitive environment variables (ONEUPTIME_SECRET, DATABASE_PASSWORD, etc.), attackers can trivially exfiltrate cluster secrets. The vulnerability is exploitable through the OneUpTime web dashboard GUI, and since open registration is enabled by default, unauthenticated external attackers can create an account and instantly compromise deployments. Patch: version 10.0.18 and later.

Affected products

OneUpTime OneUpTime < 10.0.18

Identifiers

CVE-2026-30887
GHSA-h343-gg57-2q67

Timeline

2026-03-07: disclosed
2026-03-07: patched: version 10.0.18

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-h343-gg57-2q67

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.