Read the docs
TI-2026-21966 Aliases CVE-2026-27574GHSA-v264-xqh4-9xmm

OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE

Priority HIGH 76CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, allowing trivial sandbox escape via a well-known one-liner that grants full access to the underlying process. Because the probe runs with host networking and holds all cluster credentials (ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, CLICKHOUSE_PASSWORD) in its environment variables, and monitor creation is available to the lowest role (ProjectMember) with open registration enabled by default, any anonymous user can achieve full cluster compromise in about 30 seconds. This issue has been fixed in version 10.0.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00561 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed oneuptime (OneUptime): 10.0.5@oneuptime/common (npm): 10.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OneUptimeoneuptimebefore 10.0.510.0.5Patch availableCNA
—@oneuptime/common (npm)before 10.0.010.0.0Patch availableGHSA-v264-xqh4-9xmm
  • oneuptime VendorOneUptime Affected before 10.0.5 Fixed in 10.0.5 Patch available CNA
  • @oneuptime/common (npm) Vendor— Affected before 10.0.0 Fixed in 10.0.0 Patch available GHSA-v264-xqh4-9xmm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*before 10.0.5VulnerableOneUptime
  • cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:* Versions before 10.0.5 Vulnerable ·OneUptime

Remediation

  • Fix · CNA oneuptime (OneUptime) Fixed in 10.0.5
  • Fix · GHSA-v264-xqh4-9xmm @oneuptime/common (npm) Fixed in 10.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27574
  2. 2026-10-03 Alias added: GHSA-v264-xqh4-9xmm
  3. 2026-10-19 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-22090 OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() CVSS 3.1CRITICAL 10.0
  • TI-2026-27002 OneUptime: Missing Authentication on Notification Endpoints CVSS 3.1CRITICAL 9.1
  • TI-2026-25573 OneUptime: WhatsApp Webhook Missing Signature Verification CVSS 4.0HIGH 8.7
  • TI-2025-40534 OneUptime Unauthorized User Creation via API CVSS 4.0HIGH 8.8
  • TI-2026-25793 Protection mechanism failure in oneuptime CVSS 3.1CRITICAL 10.0
  • TI-2026-24835 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters CVSS 3.1CRITICAL 10.0
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences