CVE-2026-30957
Description
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container. The root cause is that untrusted Synthetic Monitor code is executed inside Node's vm while live host-realm Playwright browser and page objects are exposed to it. A malicious user can call Playwright APIs on the injected browser object and cause the probe to spawn an attacker-controlled executable. This is a server-side remote code execution issue. It does not require a separate vm sandbox escape. This vulnerability is fixed in 10.0.21.
How to fix
- hackerbay oneuptime10.0.21 or later
- @oneuptime/common10.0.21 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hackerbay oneuptime | v < 10.0.21 | 10.0.21 |
| @oneuptime/commonnpm | v < 10.0.21 | 10.0.21 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.