# CVE-2026-30887: OneUpTime unsandboxed code execution in Probe allowing RCE

Source: https://junglewise.ai/threats/cve-2026-30887-oneuptime-unsandboxed-code-execution-in-probe-allowing-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-30887 · Severity: low · CVSS 3.1 · Published 2026-03-07

OneUpTime is an open-source monitoring platform that allows project members to write custom JavaScript/Playwright code within Synthetic Monitors to test websites. A critical sandbox escape vulnerability in the Node.js vm module execution allows any project member to bypass the sandbox, execute arbitrary system commands on the probe container, and access sensitive environment variables containing database credentials, resulting in complete cluster compromise.

Technologies: [@oneuptime/common (npm)](https://junglewise.ai/threats/technologies/oneuptime-common), [OneUptime](https://junglewise.ai/threats/technologies/oneuptime). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [OneUptime](https://junglewise.ai/threats/vendors/oneuptime).

## Quick answers

**Is CVE-2026-30887 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30887 being exploited in the wild.

**How severe is CVE-2026-30887?** Low severity, with a CVSS score of 3.1, published 7 March 2026.

**Which products and versions are affected?** @oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.18; OneUptime < 10.0.18.

**Is there a fix for CVE-2026-30887?** Yes. @oneuptime/common (npm): upgrade to 10.0.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-30887 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-30887?** Check whether you run @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @oneuptime/common (npm): upgrade to 10.0.18 or later

  ```sh
  npm install @oneuptime/common@10.0.18
  ```


## Technical details

The vulnerability exists in Common/Server/Utils/VM/VMRunner.ts where user-supplied JavaScript is executed using vm.runInContext() without any AST filtering or secure isolation. An attacker with Project Member privileges can use a prototype-chain escape payload (this.constructor.constructor('return process')()) to bypass the sandbox, gain access to the underlying Node.js process object, and execute arbitrary shell commands via the child_process module. Since the oneuptime-probe service runs with access to sensitive environment variables (ONEUPTIME_SECRET, DATABASE_PASSWORD, etc.), attackers can trivially exfiltrate cluster secrets. The vulnerability is exploitable through the OneUpTime web dashboard GUI, and since open registration is enabled by default, unauthenticated external attackers can create an account and instantly compromise deployments. Patch: version 10.0.18 and later.

## Affected products

- OneUpTime OneUpTime < 10.0.18

## Identifiers

- CVE-2026-30887
- GHSA-h343-gg57-2q67

## Timeline

- 2026-03-07: disclosed
- 2026-03-07: patched: version 10.0.18

## References

- [https://github.com/OneUptime/oneuptime/security/advisories/GHSA-h343-gg57-2q67](https://github.com/OneUptime/oneuptime/security/advisories/GHSA-h343-gg57-2q67)

## Related threats

- [OneUptime authorization bypass in Kubernetes cluster operations](https://junglewise.ai/threats/cve-2026-112047-oneuptime-14-0-2-before-14-0-69-contains-an-incorrect)
- [OneUptime webhook SSRF via IPv4-mapped IPv6 addresses](https://junglewise.ai/threats/cve-2026-80350-oneuptime-webhook-ssrf-via-ipv4-mapped-ipv6-addresses)
- [OneUptime sandbox escape in VMRunner leading to RCE](https://junglewise.ai/threats/cve-2026-45102-oneuptime-sandbox-escape-in-vmrunner-leading-to-rce)
- [OneUptime missing authentication in Worker ManualAPI workflow execution](https://junglewise.ai/threats/cve-2026-35053-oneuptime-missing-authentication-in-worker-manualapi-workflow)
- [OneUptime SAML SSO authentication bypass via identity injection](https://junglewise.ai/threats/cve-2026-34840-oneuptime-saml-sso-authentication-bypass-via-identity-injection)