Executive brief
OneUptime is a monitoring and alerting platform that supports synthetic monitors—automated browser-based tests that verify web application availability. A low-privileged authenticated user can inject malicious code into synthetic monitor scripts that executes with the privileges of the OneUptime probe server. By exploiting exposed Playwright browser objects within the sandboxed script environment, an attacker can execute arbitrary system commands on the monitoring infrastructure, leading to full system compromise.
Technical details
OneUptime executes user-supplied Playwright code inside a Node.js VM sandbox for synthetic monitoring; however, live Playwright browser and page objects are injected directly into the VM context. The VMRunner proxy implementation only blocks a small set of property names (constructor, __proto__, prototype, mainModule) but forwards all normal method calls with the real host `this` binding. An authenticated attacker can invoke legitimate Playwright APIs on the injected browser object—specifically `browser.browserType().launch()` with attacker-controlled `executablePath` and `args` parameters—causing the probe to spawn arbitrary commands via child-process spawn. This execution occurs within both one-shot monitor testing and scheduled monitor runs. The vulnerability is not a VM sandbox escape; rather, it is a direct exposure of dangerous capabilities through the injected objects by design. Affected versions through 10.0.20 are vulnerable; patched in 10.0.21.
Affected products
- OneUptime oneuptime <= 10.0.20
Timeline
- 2026-03-10: disclosed
- 2026-03-10: patched: Version 10.0.21 contains the fix