Critical severityNVD Advisory· Published Feb 25, 2026· Updated Feb 25, 2026
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
CVE-2026-27728
Description
OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in NetworkPathMonitor.performTraceroute() allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into a monitor's destination field. Version 10.0.7 fixes the vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@oneuptime/commonnpm | < 10.0.7 | 10.0.7 |
Affected products
2- OneUptime/oneuptimev5Range: < 10.0.7
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-jmhp-5558-qxh5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27728ghsaADVISORY
- github.com/OneUptime/oneuptime/commit/f2cce35a04fac756cecc7a4c55e23758b99288c1ghsax_refsource_MISCWEB
- github.com/OneUptime/oneuptime/security/advisories/GHSA-jmhp-5558-qxh5ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.