Is CVE-2026-30921 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30921 being exploited in the wild.

How severe is CVE-2026-30921?

Low severity, with a CVSS score of 3.1, published 7 March 2026.

Which products and versions are affected?

@oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.20; OneUptime < 10.0.20.

Is there a fix for CVE-2026-30921?

Yes. @oneuptime/common (npm): upgrade to 10.0.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30921 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-30921?

Check whether you run @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30921: OneUptime Synthetic Monitor remote code execution via exposed Playwright

Q: Is there a fix for CVE-2026-30921?

Yes. @oneuptime/common (npm): upgrade to 10.0.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-30921 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-30921?

Check whether you run @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30921 · Severity: low · CVSS 3.1 · Published 2026-03-07

OneUptime is an open-source monitoring and observability platform. The Synthetic Monitor feature allows authenticated project members to submit custom Playwright browser automation code that runs on probe servers. An attacker with project membership can craft malicious code to execute arbitrary commands on the probe host by leveraging exposed Playwright browser objects, leading to complete compromise of the probe infrastructure and access to secrets or internal services.

Technologies: @oneuptime/common (npm), OneUptime. Vendors: npm, OneUptime.

Quick answers

Is CVE-2026-30921 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30921 being exploited in the wild.
How severe is CVE-2026-30921?: Low severity, with a CVSS score of 3.1, published 7 March 2026.
Which products and versions are affected?: @oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.20; OneUptime < 10.0.20.
Is there a fix for CVE-2026-30921?: Yes. @oneuptime/common (npm): upgrade to 10.0.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30921 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-30921?: Check whether you run @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@oneuptime/common (npm): upgrade to 10.0.20 or later
```
npm install @oneuptime/common@10.0.20
```

Technical details

The vulnerability is a server-side remote code execution (RCE) in the probe component's Synthetic Monitor execution handler. The root cause is unsafe exposure of host-level Playwright browser and page objects into an untrusted Node.js VM sandbox. When user-supplied Playwright code is executed via VMRunner.runCodeInNodeVM(), the injected browser object retains full capability to invoke browserType().launch() with attacker-controlled parameters (executablePath, args, ignoreDefaultArgs), allowing arbitrary process execution on the probe host or container. The proxy wrapper intended to restrict dangerous properties only blocks a limited set of names and still forwards method calls with the real host binding. This is distinct from classic VM sandbox escapes—no prototype chain exploitation is needed. Attack precondition: valid project membership. The vulnerability affects both one-shot test monitor execution and persistent scheduled monitors. Fixed in version 10.0.20.

Affected products

OneUptime OneUptime < 10.0.20

Identifiers

CVE-2026-30921
GHSA-4j36-39gm-8vq8

Timeline

2026-03-07: disclosed
2026-03-07: patched: Version 10.0.20 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.