CVE-2026-27574
published 2026-02-21CVE-2026-27574: OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm…
PriorityP263critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
0.50%
39.3th percentile
OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, allowing trivial sandbox escape via a well-known one-liner that grants full access to the underlying process. Because the probe runs with host networking and holds all cluster credentials (ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, CLICKHOUSE_PASSWORD) in its environment variables, and monitor creation is available to the lowest role (ProjectMember) with open registration enabled by default, any anonymous user can achieve full cluster compromise in about 30 seconds. This issue has been fixed in version 10.0.5.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hackerbay | oneuptime | < 10.0.5 | 10.0.5 |
| oneuptime | common | >= 0 < 10.0.0 | 10.0.0 |
| oneuptime | oneuptime | < 10.0.5 | 10.0.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE
ghsa·2026-02-24
CVE-2026-27574 [CRITICAL] CWE-94 OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE
OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE
### Summary
OneUptime lets project members write custom JavaScript that runs inside monitors. The problem is it executes that code using Node.js's built-in `vm` module, which Node.js itself documents as "not a security mechanism — do not use it to run untrusted code." The classic one-liner escape gives full access to the underlying process, and since the probe runs with host networking and holds all cluster credentials in its environment, this turns into a full cluster compromise for anyone who can register an account.
### Details
The vulnerable code is in `Common/Server/Utils/VM/VMRunner.ts` at line 55:
```typescript
vm.runInContext(script, sandbox, { timeout })
```
The JavaScript that reaches this
OSV
OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE
osv·2026-02-24
CVE-2026-27574 [CRITICAL] OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE
OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE
### Summary
OneUptime lets project members write custom JavaScript that runs inside monitors. The problem is it executes that code using Node.js's built-in `vm` module, which Node.js itself documents as "not a security mechanism — do not use it to run untrusted code." The classic one-liner escape gives full access to the underlying process, and since the probe runs with host networking and holds all cluster credentials in its environment, this turns into a full cluster compromise for anyone who can register an account.
### Details
The vulnerable code is in `Common/Server/Utils/VM/VMRunner.ts` at line 55:
```typescript
vm.runInContext(script, sandbox, { timeout })
```
The JavaScript that reaches this
No detection rules found.
No public exploits indexed.
2026-02-21
Published