CVE-2026-30957 | OneUptime is a solution for monitoring and managing online s… | CVSS 10.0 CRITICAL

Description

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container. The root cause is that untrusted Synthetic Monitor code is executed inside Node's vm while live host-realm Playwright browser and page objects are exposed to it. A malicious user can call Playwright APIs on the injected browser object and cause the probe to spawn an attacker-controlled executable. This is a server-side remote code execution issue. It does not require a separate vm sandbox escape. This vulnerability is fixed in 10.0.21.

Metadata

CVE ID: CVE-2026-30957
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-03-07 17:34 UTC
Published: 2026-03-10 16:58 UTC
Last updated: 2026-03-10 18:22 UTC
Primary CWE: CWE-749
CWE-749: Exposed Dangerous Method or Function
Vendor / Product: OneUptime / oneuptime
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
OneUptime	oneuptime	—	< 10.0.21

Weakness (CWE)

CWE	Source	Description
CWE-749	cna	CWE-749: Exposed Dangerous Method or Function

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (2)

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-jw8q-gjvg-8w4q https://github.com/OneUptime/oneuptime/security/advisories/GHSA-jw8q-gjvg-8w4q
https://github.com/OneUptime/oneuptime/releases/tag/10.0.21 https://github.com/OneUptime/oneuptime/releases/tag/10.0.21