Critical severity9.9NVD Advisory· Published Feb 25, 2026· Updated Jun 17, 2026

CVE-2026-27728

Description

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in NetworkPathMonitor.performTraceroute() allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into a monitor's destination field. Version 10.0.7 fixes the vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@oneuptime/commonnpm	< 10.0.7	10.0.7

Affected products

ghsa-coords
pkg:npm/%40oneuptime/common
Range: < 10.0.7
Hackerbay/Oneuptime
cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*
Range: <10.0.7
Oneuptime/Oneuptimecpe-rescue
Range: < 10.0.7

Patches

Vulnerability mechanics

References

github.com/OneUptime/oneuptime/commit/f2cce35a04fac756cecc7a4c55e23758b99288c1nvdPatchWEB
github.com/OneUptime/oneuptime/security/advisories/GHSA-jmhp-5558-qxh5nvdExploitVendor AdvisoryWEB
github.com/advisories/GHSA-jmhp-5558-qxh5ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-27728ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000