CVE-2026-27574: falha crítica em oneuptime
OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 10epss 0.6%
OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, allowing trivial sandbox escape via a well-known one-liner that grants full access to the underlying process. Because the probe runs with host networking and holds all cluster credentials (ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, CLICKHOUSE_PASSWORD) in its environment variables, and monitor creation is available to the lowest role (ProjectMember) with open registration enabled by default, any anonymous user can achieve full cluster compromise in about 30 seconds. This issue has been fixed in version 10.0.5.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
OneUptime · oneuptimeCVEs relacionadas — oneuptime
No mesmo produto, das mais perigosas para as menos.
CVE-2026-27728CRITICALOneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()EPSS 2.0%CVE-2026-30957CRITICALOneUptime Synthetic Monitor RCE via exposed Playwright browser objectEPSS 1.3%CVE-2026-30958HIGHOneUptime: Path Traversal — Arbitrary File Read (No Auth)EPSS 1.2%CVE-2026-33396CRITICALOneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on ProbeEPSS 0.8%CVE-2026-32306CRITICALOneUptime ClickHouse SQL Injection via Aggregate Query ParametersEPSS 0.7%CVE-2024-29194HIGHOneUptime Vulnerable to a Privilege Escalation via Local Storage Key ManipulationEPSS 0.7%