PT-2026-24093 · Microsoft+1 · Playright+1
Maru1009
·
Publicado
2026-03-07
·
Atualizado
2026-03-12
·
CVE-2026-30921
CVSS v3.1
9.9
Crítica
| Vetor | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OneUptime versions prior to 10.0.20
Description
OneUptime Synthetic Monitors allow low-privileged project users to submit custom Playwright code that is executed on the
oneuptime-probe service. This code runs within Node's vm and is provided with live host Playwright objects, such as browser and page. This allows an attacker to use the injected browser object to execute arbitrary code on the probe host/container via browser.browserType().launch(...). The issue stems from exposing dangerous host capabilities to untrusted code, rather than relying on traditional sandbox escapes. This can be exploited through the Test Monitor feature or by creating a malicious Synthetic Monitor, leading to server-side Remote Code Execution (RCE). The customCode is passed into SyntheticMonitor.execute(...) and then executed through VMRunner.runCodeInNodeVM(...), which creates a Node vm context and exposes host objects. The proxy wrapper does not sufficiently block property names, allowing legitimate Playwright methods to be called with the real host this binding.Recommendations
Versions prior to 10.0.20 should be updated to version 10.0.20 or later.
Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Oneuptime
Playright