{"id":"EUVD-2026-10561","enisaUuid":"729777e1-838f-3826-86f2-f38943e4c614","description":"OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container. The root cause is that untrusted Synthetic Monitor code is executed inside Node\u0027s vm while live host-realm Playwright browser and page objects are exposed to it. A malicious user can call Playwright APIs on the injected browser object and cause the probe to spawn an attacker-controlled executable. This is a server-side remote code execution issue. It does not require a separate vm sandbox escape. This vulnerability is fixed in 10.0.21.","datePublished":"Mar 10, 2026, 4:58:28 PM","dateUpdated":"Mar 10, 2026, 6:22:16 PM","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-jw8q-gjvg-8w4q\nhttps://github.com/OneUptime/oneuptime/releases/tag/10.0.21\n","aliases":"CVE-2026-30957\nGHSA-jw8q-gjvg-8w4q\n","assigner":"GitHub_M","epss":1.3,"enisaIdProduct":[{"id":"5502c7c6-dc86-3cc3-95f9-162fd6e60ed6","product":{"name":"oneuptime","vendor":{"name":"OneUptime"}},"product_version":"\u003c 10.0.21"}],"enisaIdVendor":[{"id":"5f219b68-2cf2-3bbe-91a3-69ea35b32afa","vendor":{"name":"OneUptime"}}],"enisaIdVulnerability":[{"id":"0a1b4179-c951-3493-88c5-0c87f18ad3eb","vulnerability":{"id":"GHSA-jw8q-gjvg-8w4q","description":"OneUptime has Synthetic Monitor RCE via exposed Playwright browser object","datePublished":"Mar 10, 2026, 1:12:59 AM","dateUpdated":"Mar 10, 2026, 6:45:14 PM","baseScore":0.0,"references":"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-jw8q-gjvg-8w4q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-30957\nhttps://github.com/OneUptime/oneuptime\nhttps://github.com/OneUptime/oneuptime/releases/tag/10.0.21\n","enisa_id":"EUVD-2026-10561\n","aliases":"CVE-2026-30957\nGHSA-jw8q-gjvg-8w4q\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:46:27 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"25f2a52c-59ab-3225-81e3-53628fb31094","vulnerability":{"id":"CVE-2026-30957","description":"OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container. The root cause is that untrusted Synthetic Monitor code is executed inside Node\u0027s vm while live host-realm Playwright browser and page objects are exposed to it. A malicious user can call Playwright APIs on the injected browser object and cause the probe to spawn an attacker-controlled executable. This is a server-side remote code execution issue. It does not require a separate vm sandbox escape. This vulnerability is fixed in 10.0.21.","datePublished":"Mar 10, 2026, 4:58:28 PM","dateUpdated":"Mar 10, 2026, 6:22:16 PM","status":"PUBLISHED","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-jw8q-gjvg-8w4q\nhttps://github.com/OneUptime/oneuptime/releases/tag/10.0.21\n","enisa_id":"EUVD-2026-10561\n","assigner":"GitHub_M","epss":1.3,"dataProcessed":"Nov 11, 2026, 7:23:09 AM","vulnerabilityProduct":[{"id":"585775e4-6f93-3f6b-b3da-f21fe4d73f6c","product":{"name":"oneuptime","vendor":{"name":"OneUptime"}},"product_version":"\u003c 10.0.21"}],"vulnerabilityVendor":[{"id":"643ad8bc-e625-310f-87be-114b922d6aec","vendor":{"name":"OneUptime"}}]}}],"enisaIdAdvisory":[]}