OneUptime Synthetic Monitor RCE via exposed Playwright browser object

Vulnerability

Overview

CVE-2026-30957 is a server-side remote code execution vulnerability in OneUptime versions prior to 10.0.21. The root cause is that untrusted Synthetic Monitor code is executed inside Node's vm module while live host-realm Playwright browser and page objects are exposed page objects are accessible to that code. This design flaw allows a low-privileged authenticated project user to craft a malicious monitor that calls Playwright APIs on the injected browser object, causing the probe to spawn an attacker-controlled executable [1][2].

Exploitation

An attacker with project member permissions can create or edit Synthetic Monitors. Because the monitor code runs in a vm context that has direct access to the host's Playwright browser and page objects, the attacker does not need to escape a sandbox; they can simply invoke Playwright methods such as child_process.spawn or similar APIs to execute arbitrary commands on the oneuptime-probe server or container [1][2].

Impact

Successful exploitation grants the attacker arbitrary command execution on the probe server. This can lead to full compromise of the monitoring infrastructure, including access to sensitive data, lateral movement within the environment, and disruption of monitoring services [1][2].

Mitigation

The vulnerability is fixed in OneUptime version 10.0.21 [1][4]. Users should upgrade immediately. No workarounds are documented; the fix likely involves restricting the execution context or removing direct access to host-realm objects [1].