PT-2026-24190 · Oneuptime+1 · Oneuptime+1

Maru1009

·

Published

2026-03-10

·

Updated

2026-03-17

·

CVE-2026-30957

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 10.0.21
Description OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container. The root cause is that untrusted Synthetic Monitor code is executed inside Node's vm while live host-realm Playwright browser and page objects are exposed to it. A malicious user can call Playwright APIs on the injected browser object and cause the probe to spawn an attacker-controlled executable. This is a server-side remote code execution issue that does not require a separate vm sandbox escape. The probe pins Playwright version 1.58.2, which allows the exploitation through the BrowserType.launch() function with attacker-controlled parameters like executablePath and args. The vulnerability is reachable through both one-shot monitor testing and normal scheduled monitor execution.
Recommendations Versions prior to 10.0.21 should be updated to version 10.0.21 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-749

Related Identifiers

CVE-2026-30957
GHSA-JW8Q-GJVG-8W4Q

Affected Products

Oneuptime
Playright