Is CVE-2026-30957 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30957 being exploited in the wild.

How severe is CVE-2026-30957?

Critical severity, with a CVSS score of 9.9, published 10 March 2026.

Which products and versions are affected?

@oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.21; OneUptime <= 10.0.20.

Is there a fix for CVE-2026-30957?

Yes. @oneuptime/common (npm): upgrade to 10.0.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30957 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-30957?

Check whether you run Hackerbay Oneuptime, @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30957: OneUptime Synthetic Monitor remote code execution via exposed Playwright browser

Q: Is there a fix for CVE-2026-30957?

Yes. @oneuptime/common (npm): upgrade to 10.0.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-30957 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-30957?

Check whether you run Hackerbay Oneuptime, @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30957 · Severity: critical · CVSS 9.9 · Published 2026-03-10

OneUptime is a monitoring and alerting platform that supports synthetic monitors—automated browser-based tests that verify web application availability. A low-privileged authenticated user can inject malicious code into synthetic monitor scripts that executes with the privileges of the OneUptime probe server. By exploiting exposed Playwright browser objects within the sandboxed script environment, an attacker can execute arbitrary system commands on the monitoring infrastructure, leading to full system compromise.

Technologies: Hackerbay Oneuptime, @oneuptime/common (npm), OneUptime. Vendors: Hackerbay, npm, OneUptime.

Quick answers

Is CVE-2026-30957 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30957 being exploited in the wild.
How severe is CVE-2026-30957?: Critical severity, with a CVSS score of 9.9, published 10 March 2026.
Which products and versions are affected?: @oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.21; OneUptime <= 10.0.20.
Is there a fix for CVE-2026-30957?: Yes. @oneuptime/common (npm): upgrade to 10.0.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30957 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-30957?: Check whether you run Hackerbay Oneuptime, @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@oneuptime/common (npm): upgrade to 10.0.21 or later
```
npm install @oneuptime/common@10.0.21
```

Technical details

OneUptime executes user-supplied Playwright code inside a Node.js VM sandbox for synthetic monitoring; however, live Playwright browser and page objects are injected directly into the VM context. The VMRunner proxy implementation only blocks a small set of property names (constructor, __proto__, prototype, mainModule) but forwards all normal method calls with the real host `this` binding. An authenticated attacker can invoke legitimate Playwright APIs on the injected browser object—specifically `browser.browserType().launch()` with attacker-controlled `executablePath` and `args` parameters—causing the probe to spawn arbitrary commands via child-process spawn. This execution occurs within both one-shot monitor testing and scheduled monitor runs. The vulnerability is not a VM sandbox escape; rather, it is a direct exposure of dangerous capabilities through the injected objects by design. Affected versions through 10.0.20 are vulnerable; patched in 10.0.21.

Affected products

OneUptime oneuptime <= 10.0.20

Identifiers

CVE-2026-30957
GHSA-jw8q-gjvg-8w4q

Timeline

2026-03-10: disclosed
2026-03-10: patched: Version 10.0.21 contains the fix

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-jw8q-gjvg-8w4q

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.