CVE-2026-30887 Details
Description
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By leveraging a standard prototype-chain escape (this.constructor.constructor), an attacker can bypass the sandbox, gain access to the underlying Node.js process object, and execute arbitrary system commands (RCE) on the oneuptime-probe container. Furthermore, because the probe holds database/cluster credentials in its environment variables, this directly leads to a complete cluster compromise. This vulnerability is fixed in 10.0.18.
A remote code execution vulnerability has been identified in OneUptime versions prior to 10.0.18. The issue arises because the application allows project members to execute custom Playwright/JavaScript code through Synthetic Monitors, using the insecure Node.js vm module. This untrusted code execution can be exploited by bypassing the sandbox, accessing the Node.js process object, and executing arbitrary system commands on the oneuptime-probe container. The vulnerability is particularly severe as it leads to a complete cluster compromise, given that the probe contains sensitive database and cluster credentials in its environment variables.
Users can upgrade to OneUptime version 10.0.18 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OneUptime/oneuptime/security/advisories/GHSA-h343-gg57-2q67 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/OneUptime/oneuptime/security/advisories/GHSA-h343-gg57-2q67 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hackerbay oneuptime | < 10.0.18 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 12, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | New CVE Received | [email protected] |