# CVE-2026-30957: OneUptime Synthetic Monitor remote code execution via exposed Playwright browser

Source: https://junglewise.ai/threats/cve-2026-30957-oneuptime-synthetic-monitor-remote-code-execution-via-exposed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-30957 · Severity: critical · CVSS 9.9 · Published 2026-03-10

OneUptime is a monitoring and alerting platform that supports synthetic monitors—automated browser-based tests that verify web application availability. A low-privileged authenticated user can inject malicious code into synthetic monitor scripts that executes with the privileges of the OneUptime probe server. By exploiting exposed Playwright browser objects within the sandboxed script environment, an attacker can execute arbitrary system commands on the monitoring infrastructure, leading to full system compromise.

Technologies: [Hackerbay Oneuptime](https://junglewise.ai/threats/technologies/hackerbay-oneuptime), [@oneuptime/common (npm)](https://junglewise.ai/threats/technologies/oneuptime-common), [OneUptime](https://junglewise.ai/threats/technologies/oneuptime). Vendors: [Hackerbay](https://junglewise.ai/threats/vendors/hackerbay), [npm](https://junglewise.ai/threats/vendors/npm), [OneUptime](https://junglewise.ai/threats/vendors/oneuptime).

## Quick answers

**Is CVE-2026-30957 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30957 being exploited in the wild.

**How severe is CVE-2026-30957?** Critical severity, with a CVSS score of 9.9, published 10 March 2026.

**Which products and versions are affected?** @oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.21; OneUptime <= 10.0.20.

**Is there a fix for CVE-2026-30957?** Yes. @oneuptime/common (npm): upgrade to 10.0.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-30957 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-30957?** Check whether you run Hackerbay Oneuptime, @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @oneuptime/common (npm): upgrade to 10.0.21 or later

  ```sh
  npm install @oneuptime/common@10.0.21
  ```


## Technical details

OneUptime executes user-supplied Playwright code inside a Node.js VM sandbox for synthetic monitoring; however, live Playwright browser and page objects are injected directly into the VM context. The VMRunner proxy implementation only blocks a small set of property names (constructor, __proto__, prototype, mainModule) but forwards all normal method calls with the real host `this` binding. An authenticated attacker can invoke legitimate Playwright APIs on the injected browser object—specifically `browser.browserType().launch()` with attacker-controlled `executablePath` and `args` parameters—causing the probe to spawn arbitrary commands via child-process spawn. This execution occurs within both one-shot monitor testing and scheduled monitor runs. The vulnerability is not a VM sandbox escape; rather, it is a direct exposure of dangerous capabilities through the injected objects by design. Affected versions through 10.0.20 are vulnerable; patched in 10.0.21.

## Affected products

- OneUptime oneuptime <= 10.0.20

## Identifiers

- CVE-2026-30957
- GHSA-jw8q-gjvg-8w4q

## Timeline

- 2026-03-10: disclosed
- 2026-03-10: patched: Version 10.0.21 contains the fix

## References

- [https://github.com/OneUptime/oneuptime/security/advisories/GHSA-jw8q-gjvg-8w4q](https://github.com/OneUptime/oneuptime/security/advisories/GHSA-jw8q-gjvg-8w4q)

## Related threats

- [OneUptime authorization bypass in Kubernetes cluster operations](https://junglewise.ai/threats/cve-2026-112047-oneuptime-14-0-2-before-14-0-69-contains-an-incorrect)
- [OneUptime webhook SSRF via IPv4-mapped IPv6 addresses](https://junglewise.ai/threats/cve-2026-80350-oneuptime-webhook-ssrf-via-ipv4-mapped-ipv6-addresses)
- [OneUptime sandbox escape in VMRunner leading to RCE](https://junglewise.ai/threats/cve-2026-45102-oneuptime-sandbox-escape-in-vmrunner-leading-to-rce)
- [OneUptime missing authentication in Worker ManualAPI workflow execution](https://junglewise.ai/threats/cve-2026-35053-oneuptime-missing-authentication-in-worker-manualapi-workflow)
- [OneUptime SAML SSO authentication bypass via identity injection](https://junglewise.ai/threats/cve-2026-34840-oneuptime-saml-sso-authentication-bypass-via-identity-injection)