CVE-2026-27574: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27574 is a critical Node.js node:vm sandbox escape vulnerability in OneUptime, an open-source monitoring and incident management platform, that allows any authenticated user (including the lowest-privilege ProjectMember role) to achieve remote code execution (RCE) on the probe host and full cluster compromise. The vulnerability was published on February 19, 2026 by researcher ByamB4 via a GitHub Security Advisory, with NVD publication on February 21, 2026. It affects all OneUptime versions below 10.0.0 (specifically versions 9.5.13 and below per the Feedly description), and has been fixed in version 10.0.5. It carries a CVSS v3.1 base score of 9.9 (Critical) (Github Advisory, GitHub Security Advisory).

The root cause is improper use of Node.js's built-in node:vm module (CWE-94: Code Injection) to execute user-supplied JavaScript code in monitors. The vulnerable code is located in Common/Server/Utils/VM/VMRunner.ts at line 55, where vm.runInContext(script, sandbox, { timeout }) is called with code sourced directly from the monitor's customCode field, which is only validated as Zod.string().optional() — no AST analysis, keyword filtering, or sanitization is applied (Github Advisory). The node:vm module is explicitly documented by Node.js as "not a security mechanism" and is trivially escaped via a well-known one-liner: this.constructor.constructor('return process')(), which grants full access to the host process. Both CustomCodeMonitor.ts and SyntheticMonitor.ts import VMRunner directly inside the probe process, and the IsolatedVM microservice (IsolatedVM/API/VM.ts:41) also calls the same vulnerable VMRunner.runCodeInSandbox() despite its misleading name. Monitor creation is accessible to Permission.ProjectMember (the lowest role), and open registration is enabled by default, making the attack surface effectively unauthenticated (GitHub Security Advisory).

Successful exploitation grants an attacker arbitrary command execution on the probe host process, full access to all cluster credentials stored in environment variables (ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, CLICKHOUSE_PASSWORD), and — because the probe runs with network_mode: host — direct network access to PostgreSQL, Redis, and ClickHouse databases. A single monitor creation by any registered user results in full cluster compromise within approximately 60 seconds of probe polling. The scope change (CVSS S:C) reflects that the impact extends well beyond the vulnerable component to the entire infrastructure (Github Advisory, GitHub Security Advisory).

A public proof-of-concept exploit is included in the official GitHub Security Advisory and a separate PoC repository (https://github.com/mbanyamer/CVE-2026-27574-OneUptime-RCE) was published on March 2, 2026. A Nuclei template pull request was also submitted to ProjectDiscovery's nuclei-templates repository. As of the latest Feedly data, there is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028% (9th percentile). The vulnerability is detected by Qualys scanner (detection ID: 5007947) (Github Advisory, Feedly).

1. Registration: Navigate to /accounts/register on the target OneUptime instance. Since open registration (disableSignup: false) is enabled by default, create a free account — no invite or admin approval required.
2. Project creation: After login, create a new project. The account is automatically assigned the ProjectMember role, which has sufficient permissions to create monitors.
3. Create a Custom JavaScript Code monitor: Go to Monitors → Add Monitor → select "Custom JavaScript Code" as the monitor type.
4. Inject sandbox escape payload: Paste the following payload into the code field:

const proc = this.constructor.constructor('return process')();
const run = proc.mainModule.require('child_process').execSync;
return {
  data: {
    secret: proc.env.ONEUPTIME_SECRET,
    db_pass: proc.env.DATABASE_PASSWORD,
    redis_pass: proc.env.REDIS_PASSWORD,
    id: run('id').toString().trim(),
    hostname: run('hostname').toString().trim()
  }
};

5. Wait for probe polling: Save the monitor and wait approximately 60 seconds for the probe to pick up and execute the monitor.
6. Harvest results: Open Monitor Logs — the response will contain the cluster secret, database password, Redis password, and the output of id and hostname running on the probe host, confirming full RCE and credential exfiltration.
7. Lateral movement: Use the harvested credentials to directly connect to PostgreSQL, Redis, and ClickHouse via the probe's host network access, achieving full cluster compromise (GitHub Security Advisory, Github Advisory).

• Logs: Monitor logs containing unexpected fields such as ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, or output of OS commands (id, hostname, whoami) in monitor result data; unusual JavaScript code in monitor customCode fields containing this.constructor.constructor, return process, child_process, or execSync.
• Network: Unexpected outbound connections from the probe host to external IPs on non-standard ports; direct inbound connections to PostgreSQL (5432), Redis (6379), or ClickHouse (8123/9000) from unusual source IPs leveraging the probe's host network.
• File System: Unexpected files written to the probe host filesystem by the probe process (e.g., web shells, reverse shell scripts, or credential dump files).
• Process: Unusual child processes spawned by the Node.js probe process (e.g., /bin/sh, /bin/bash, curl, wget, python) visible in process trees; execSync or spawn calls originating from the probe's Node.js PID.
• Application: New monitors of type "Custom JavaScript Code" created by low-privilege or newly registered accounts, especially with obfuscated or suspicious code content (GitHub Security Advisory).

Upgrade OneUptime to version 10.0.5 (or at minimum 10.0.0) immediately, as the fix replaces the insecure node:vm module with the isolated-vm npm package, which provides real V8 isolate sandboxing (GitHub Patch). If an immediate upgrade is not possible, consider the following interim mitigations: disable the Custom JavaScript Code monitor feature, restrict monitor creation permissions to admin roles only, and disable open registration (disableSignup: true) to prevent anonymous account creation. Additionally, rotate all cluster credentials (ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, CLICKHOUSE_PASSWORD) if exposure is suspected, and review probe network access to limit host networking where possible (Github Advisory, GitHub Security Advisory).

The vulnerability received coverage from The Hacker Wire, which published a dedicated article on the critical RCE via Node.js sandbox escape (The Hacker Wire). Security researcher ByamB4 was credited with the discovery in the official advisory. The vulnerability was discussed on Mastodon and Bluesky by security community accounts, and was featured in a PoC weekly digest by tonyharris.io. The infinitsec.net blog also published a technical write-up on the sandbox escape mechanism (infinitsec). National CERTs including INCIBE-CERT (Spain) and CCN-CERT published alerts on the vulnerability.