Executive brief
OneUptime is an open-source platform used for monitoring and observability of IT infrastructure. A security flaw in its code execution engine allows users with basic dashboard access to bypass security restrictions and run unauthorized commands on the underlying server. This could lead to a complete system takeover, theft of sensitive configuration data, or disruption of monitoring services.
Technical details
OneUptime is vulnerable to a sandbox escape leading to Remote Code Execution (RCE). The application utilized the Node.js 'vm' module as a security boundary for executing user-provided Playwright code in Synthetic Monitors. Because the 'vm' module is not a secure isolation primitive, an attacker can use techniques involving infinite recursion and error objects to access the host's global object and prototype chain. By exploiting this escape, a user with low-level project permissions can execute arbitrary shell commands on the host server. The issue is resolved in version 10.0.98 by migrating to a more secure isolation method.
Affected products
- OneUptime OneUptime < 10.0.98
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD