OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

Vulnerability

Overview

CVE-2026-30887 is a critical sandbox escape vulnerability in OneUptime, an open-source monitoring and observability platform. The root cause lies in the Common/Server/Utils/Server/Utils/VM/VMRunner.ts file, where user-supplied JavaScript code from Synthetic Monitors is executed using the Node.js vm.runInContext() method [2]. The Node.js documentation explicitly warns that the vm module is not a security boundary and should never be used to run untrusted code, yet OneUptime passed user input directly to this function without any AST filtering or secure isolation [2].

Exploitation

An attacker with at least "Project Member" permissions can exploit this vulnerability entirely through the OneUptime web dashboard GUI [2]. By creating a Synthetic Monitor and injecting a standard prototype-chain escape payload such as const proc = this.constructor.constructor('return process')('return process')();, the attacker can bypass the sandbox and gain access to the underlying Node.js process object [1][2]. From there, they can require child_process to execute arbitrary shell commands on the oneuptime-probe container [2].

Impact

Successful exploitation leads to remote code execution (RCE) on the probe container. Because the probe holds sensitive environment variables such as ONEUPTIME_SECRET and and DATABASE_PASSWORD`, an attacker can exfiltrate these secrets to an external server [2]. This directly results in a complete cluster compromise, as the credentials provide access to the database and other cluster resources [1][2].

Mitigation

The vulnerability is fixed in OneUptime version 10.0.18 [1][2]. Users should upgrade immediately. No workarounds are documented; the fix likely involves replacing the insecure isolation mechanisms such as isolated-vm or running untrusted code in a dedicated restricted container [2].