CVE-2026-30957: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30957 is a critical server-side Remote Code Execution (RCE) vulnerability in OneUptime's Synthetic Monitor feature, titled "Synthetic Monitor RCE via exposed Playwright browser object." It affects all versions of the oneuptime and @oneuptime/common npm packages prior to 10.0.21, and was published on March 8, 2026, with NVD publication on March 10, 2026. A low-privileged authenticated project member can exploit this flaw to execute arbitrary commands on the oneuptime-probe server or container. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, OneUptime Advisory).

The root cause is classified as CWE-749 (Exposed Dangerous Method or Function): untrusted Synthetic Monitor JavaScript code is executed inside Node.js's vm module, but live host-realm Playwright browser and page objects are injected directly into the VM sandbox context (GitHub Advisory). The VMRunner.runCodeInNodeVM() function wraps these objects in proxies but only blocks a narrow set of property names (constructor, __proto__, prototype, mainModule), while still forwarding all other method calls with the real host this binding. Because Browser.browserType().launch() in Playwright 1.58.2 (pinned by the probe) accepts attacker-controlled executablePath, ignoreDefaultArgs, and args parameters and passes them to a child-process spawn path, an attacker can call browser.browserType().launch({ executablePath: "/bin/sh", ignoreDefaultArgs: true, args: ["-c", "id"] }) from within the sandboxed script to spawn arbitrary executables — no VM sandbox escape is required (OneUptime Advisory). The exploit is reachable via both one-shot monitor testing and normal scheduled monitor execution, and any project member has the access control permissions needed to create or edit monitors and monitor tests.

Successful exploitation grants an attacker arbitrary command execution on the oneuptime-probe server or container with the privileges of the probe process, resulting in full compromise of confidentiality, integrity, and availability of that component (OneUptime Advisory). Because the probe typically has access to internal services, Kubernetes metadata, database credentials, proxy credentials, and other cluster-local trust relationships, a successful attack can enable significant lateral movement within the hosting environment. The scope is marked as "Changed" in CVSS, reflecting that the impact extends beyond the vulnerable component itself to the broader infrastructure.

A detailed proof-of-concept (PoC) with step-by-step reproduction instructions and a specific JavaScript payload is publicly available in the official security advisory (OneUptime Advisory). The exploit requires only low privileges (ordinary project membership) and no user interaction, making it straightforward to weaponize. The EPSS score is approximately 0.112% (29th percentile), and as of the time of reporting there is no confirmed evidence of in-the-wild exploitation or threat actor attribution (GitHub Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Obtain project membership: Register or gain access to a OneUptime instance as a low-privileged project member (ProjectMember role is sufficient).
2. Navigate to Monitors: In the OneUptime dashboard, go to Monitors → Create New Monitor.
3. Select Synthetic Monitor: Choose the "Synthetic Monitor" type, which exposes a Playwright code editor.
4. Inject malicious payload: In the Playwright code field, paste the following JavaScript payload:

browser.browserType().launch({
  executablePath: "/bin/sh",
  ignoreDefaultArgs: true,
  args: ["-c", "id"],
  timeout: 1000,
}).catch((err) => {
  console.log(String(err));
});
return { data: { launched: true } };

5. Configure monitor settings: Select a browser type (e.g., Chromium) and a screen size type (e.g., Desktop); set retry count to 0.
6. Trigger execution: Click Test Monitor and select any available probe to queue the test run.
7. Observe command output: The probe executes the injected command (id) on the server; the output appears in the monitor test results under "Show More Details."
8. Escalate: Replace the id command with a reverse shell, data exfiltration command, or other payload to achieve persistent access or lateral movement within the probe's network environment (OneUptime Advisory).

• Logs: OneUptime probe logs showing unexpected child process spawns from the Node.js probe process (e.g., /bin/sh, bash, curl, wget, python) during Synthetic Monitor execution; monitor test result output containing OS command output (e.g., uid=, gid=) in the "Show More Details" field.
• Process: Unusual child processes (e.g., /bin/sh -c <command>) spawned by the oneuptime-probe Node.js process; unexpected network connections originating from the probe container to external IPs.
• Network: Outbound connections from the probe server/container to attacker-controlled infrastructure, particularly following Synthetic Monitor test executions; DNS lookups for unfamiliar domains initiated by the probe process.
• File System: New files or scripts written to the probe container's filesystem by the probe process; unexpected cron jobs, SSH keys, or persistence mechanisms added under the probe service account (OneUptime Advisory).

The vulnerability is fixed in OneUptime version 10.0.21, released March 8, 2026; all users should upgrade immediately (OneUptime Release). As an interim workaround, restrict Synthetic Monitor creation and modification permissions to trusted users only (e.g., ProjectOwner or ProjectAdmin roles), preventing untrusted project members from injecting malicious code. Additionally, monitor probe servers for suspicious process execution originating from Node.js processes, and consider network-segmenting probe containers to limit the blast radius of any successful exploitation (GitHub Advisory).

The vulnerability received coverage from The Hacker Wire, which published an article specifically on the RCE in OneUptime Synthetic Monitors (The Hacker Wire), and SecurityOnline.info noted it alongside other critical OneUptime flaws in a piece titled "Maximum 10.0 CVSS Flaws in OneUptime Allow Full Account Takeovers and RCE" (SecurityOnline). The advisory was also highlighted in PoC-focused security digests such as Tony Harris's weekly PoC roundups for the weeks of March 16 and March 23, 2026. Community reaction focused on the design-level nature of the flaw — that no VM sandbox escape was needed because dangerous capabilities were exposed by design — which was noted as a particularly instructive case of insecure sandbox architecture.