CVE-2026-33396 Details
Description
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMember) can achieve remote command execution on the Probe container/host by abusing Synthetic Monitor Playwright script execution. Synthetic monitor code is executed in VMRunner.runCodeInNodeVM with a live Playwright page object in context. The sandbox relies on a denylist of blocked properties/methods, but it is incomplete. Specifically, _browserType and launchServer are not blocked, so attacker code can traverse `page.context().browser()._browserType.launchServer(...)` and spawn arbitrary processes. Version 10.0.35 contains a patch.
A remote command execution vulnerability has been identified in OneUptime versions prior to 10.0.35. This issue allows low-privileged authenticated users (ProjectMembers) to execute arbitrary commands on the Probe container or host. The vulnerability arises from the Synthetic Monitor's Playwright script execution, where the sandbox environment fails to adequately block certain properties and methods. Specifically, the '_browserType' and 'launchServer' properties are not restricted, enabling attackers to traverse the Playwright page context and spawn arbitrary processes. The vulnerability takes advantage of the incomplete denylist of blocked properties, allowing for unauthorized command execution on the host.
Users can update to OneUptime version 10.0.35 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cqpg-phpp-9jjg | CISA-ADP | ExploitVendor Advisory |
| https://github.com/OneUptime/oneuptime/commit/e8e4ee3ff0740eb131045ab3d67453141c46178a | [email protected] | Patch |
| https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cqpg-phpp-9jjg | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
| CWE-693 | Protection Mechanism Failure | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hackerbay oneuptime | < 10.0.35 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | New CVE Received | [email protected] |