Junglewise Threat Intelligence

CVE-2026-30921: OneUptime Synthetic Monitor remote code execution via exposed Playwright

CVE-2026-30921 · Severity: low · CVSS 3.1 · Published 2026-03-07

Technologies: @oneuptime/common (npm), OneUptime. Vendors: npm, OneUptime.

Executive brief

OneUptime is an open-source monitoring and observability platform. The Synthetic Monitor feature allows authenticated project members to submit custom Playwright browser automation code that runs on probe servers. An attacker with project membership can craft malicious code to execute arbitrary commands on the probe host by leveraging exposed Playwright browser objects, leading to complete compromise of the probe infrastructure and access to secrets or internal services.

Technical details

The vulnerability is a server-side remote code execution (RCE) in the probe component's Synthetic Monitor execution handler. The root cause is unsafe exposure of host-level Playwright browser and page objects into an untrusted Node.js VM sandbox. When user-supplied Playwright code is executed via VMRunner.runCodeInNodeVM(), the injected browser object retains full capability to invoke browserType().launch() with attacker-controlled parameters (executablePath, args, ignoreDefaultArgs), allowing arbitrary process execution on the probe host or container. The proxy wrapper intended to restrict dangerous properties only blocks a limited set of names and still forwards method calls with the real host binding. This is distinct from classic VM sandbox escapes—no prototype chain exploitation is needed. Attack precondition: valid project membership. The vulnerability affects both one-shot test monitor execution and persistent scheduled monitors. Fixed in version 10.0.20.

Affected products

  • OneUptime OneUptime < 10.0.20

Timeline

  • 2026-03-07: disclosed
  • 2026-03-07: patched: Version 10.0.20 released with fix

References

Related threats