# CVE-2026-30921: OneUptime Synthetic Monitor remote code execution via exposed Playwright

Source: https://junglewise.ai/threats/cve-2026-30921-oneuptime-synthetic-monitor-remote-code-execution-via-exposed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-30921 · Severity: low · CVSS 3.1 · Published 2026-03-07

OneUptime is an open-source monitoring and observability platform. The Synthetic Monitor feature allows authenticated project members to submit custom Playwright browser automation code that runs on probe servers. An attacker with project membership can craft malicious code to execute arbitrary commands on the probe host by leveraging exposed Playwright browser objects, leading to complete compromise of the probe infrastructure and access to secrets or internal services.

Technologies: [@oneuptime/common (npm)](https://junglewise.ai/threats/technologies/oneuptime-common), [OneUptime](https://junglewise.ai/threats/technologies/oneuptime). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [OneUptime](https://junglewise.ai/threats/vendors/oneuptime).

## Quick answers

**Is CVE-2026-30921 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30921 being exploited in the wild.

**How severe is CVE-2026-30921?** Low severity, with a CVSS score of 3.1, published 7 March 2026.

**Which products and versions are affected?** @oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.20; OneUptime < 10.0.20.

**Is there a fix for CVE-2026-30921?** Yes. @oneuptime/common (npm): upgrade to 10.0.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-30921 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-30921?** Check whether you run @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @oneuptime/common (npm): upgrade to 10.0.20 or later

  ```sh
  npm install @oneuptime/common@10.0.20
  ```


## Technical details

The vulnerability is a server-side remote code execution (RCE) in the probe component's Synthetic Monitor execution handler. The root cause is unsafe exposure of host-level Playwright browser and page objects into an untrusted Node.js VM sandbox. When user-supplied Playwright code is executed via VMRunner.runCodeInNodeVM(), the injected browser object retains full capability to invoke browserType().launch() with attacker-controlled parameters (executablePath, args, ignoreDefaultArgs), allowing arbitrary process execution on the probe host or container. The proxy wrapper intended to restrict dangerous properties only blocks a limited set of names and still forwards method calls with the real host binding. This is distinct from classic VM sandbox escapes—no prototype chain exploitation is needed. Attack precondition: valid project membership. The vulnerability affects both one-shot test monitor execution and persistent scheduled monitors. Fixed in version 10.0.20.

## Affected products

- OneUptime OneUptime < 10.0.20

## Identifiers

- CVE-2026-30921
- GHSA-4j36-39gm-8vq8

## Timeline

- 2026-03-07: disclosed
- 2026-03-07: patched: Version 10.0.20 released with fix

## References

- [https://github.com/OneUptime/oneuptime/security/advisories/GHSA-4j36-39gm-8vq8](https://github.com/OneUptime/oneuptime/security/advisories/GHSA-4j36-39gm-8vq8)
- [https://github.com/OneUptime/oneuptime](https://github.com/OneUptime/oneuptime)
- [https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/App/FeatureSet/Dashboard/src/Components/Form/Monitor/MonitorStep.tsx](https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/App/FeatureSet/Dashboard/src/Components/Form/Monitor/MonitorStep.tsx)
- [https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/App/FeatureSet/Dashboard/src/Components/Form/Monitor/MonitorTest.tsx](https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/App/FeatureSet/Dashboard/src/Components/Form/Monitor/MonitorTest.tsx)
- [https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Common/Models/DatabaseModels/Monitor.ts](https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Common/Models/DatabaseModels/Monitor.ts)
- [https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Common/Models/DatabaseModels/MonitorTest.ts](https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Common/Models/DatabaseModels/MonitorTest.ts)

## Related threats

- [OneUptime authorization bypass in Kubernetes cluster operations](https://junglewise.ai/threats/cve-2026-112047-oneuptime-14-0-2-before-14-0-69-contains-an-incorrect)
- [OneUptime webhook SSRF via IPv4-mapped IPv6 addresses](https://junglewise.ai/threats/cve-2026-80350-oneuptime-webhook-ssrf-via-ipv4-mapped-ipv6-addresses)
- [OneUptime sandbox escape in VMRunner leading to RCE](https://junglewise.ai/threats/cve-2026-45102-oneuptime-sandbox-escape-in-vmrunner-leading-to-rce)
- [OneUptime missing authentication in Worker ManualAPI workflow execution](https://junglewise.ai/threats/cve-2026-35053-oneuptime-missing-authentication-in-worker-manualapi-workflow)
- [OneUptime SAML SSO authentication bypass via identity injection](https://junglewise.ai/threats/cve-2026-34840-oneuptime-saml-sso-authentication-bypass-via-identity-injection)