Remote Code Execution in OneUptime Monitoring Solution

CVE-2026-30887

What is CVE-2026-30887?

OneUptime, a monitoring and management solution for online services, previously allowed project members to execute custom Playwright/JavaScript code via Synthetic Monitors. Before version 10.0.18, this functionality was poorly secured, as it run untrusted code within an insecure Node.js virtual machine module. Attackers could exploit this flaw using a common prototype-chain escape technique, effectively bypassing the sandbox protections. As a result, malicious actors could gain unauthorized access to the Node.js process object, leading to arbitrary command execution on the oneuptime-probe container. This access included exposure of critical database and cluster credentials contained in the probe's environment variables, enabling a compromising attack on the entire cluster. The vulnerability is addressed in version 10.0.18.

References