https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:33:59 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-30887 <p>OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By leveraging a standard prototype-chain escape (this.constructor.constructor), an attacker can bypass the sandbox, gain access to the underlying Node.js process object, and execute arbitrary system commands (RCE) on the oneuptime-probe container. Furthermore, because the probe holds database/cluster credentials in its environment variables, this directly leads to a complete cluster compromise. This vulnerability is fixed in 10.0.18.</p> <p>OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By leveraging a standard prototype-chain escape (this.constructor.constructor), an attacker can bypass the sandbox, gain access to the underlying Node.js process object, and execute arbitrary system commands (RCE) on the oneuptime-probe container. Furthermore, because the probe holds database/cluster credentials in its environment variables, this directly leads to a complete cluster compromise. This vulnerability is fixed in 10.0.18.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-30887 https://vulnerability.circl.lu/vuln/ghsa-h343-gg57-2q67 <p><strong>Affected:</strong> npm: @oneuptime/common</p> <p>### Summary OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js `vm` module. By leveraging a standard prototype-chain escape (`this.constructor.constructor`), an attacker can bypass the sandbox, gain access to the underlying Node.js `process` object, and execute arbitrary system commands (RCE) on the `oneuptime-probe` container. Furthermore, because the probe holds database/cluster credentials in its environment variables, this directly leads to a complete cluster compromise.</p> <p>### Details The root cause of the vulnerability exists in [Common/Server/Utils/VM/VMRunner.ts](oneuptime/Common/Server/Utils/VM/VMRunner.ts) where user-supplied JavaScript is executed using `vm.runInContext()`:</p> <p>```typescript const vmPromise = vm.runInContext(script, sandbox, { ... }); ```</p> <p>The Node.js documentation explicitly warns that the `vm` module is not a security boundary and should never be used to run untrusted code.</p> <p>When a user creates a **Synthetic Monitor**, the code inputted into the Playwright script editor is passed directly to this backend function without any AST filtering or secure isolation (e.g., `isolated-vm` or a dedicated restricted container).</p> <p>An attacker can use the payload `const proc = this.constructor.constructor(&#39;return process&#39;)();` to step out of the sandbox context and grab the host&#39;s native `process` object. From there, th…</p> <p><strong>Affected:</strong> npm: @oneuptime/common</p> <p>### Summary OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js `vm` module. By leveraging a standard prototype-chain escape (`this.constructor.constructor`), an attacker can bypass the sandbox, gain access to the underlying Node.js `process` object, and execute arbitrary system commands (RCE) on the `oneuptime-probe` container. Furthermore, because the probe holds database/cluster credentials in its environment variables, this directly leads to a complete cluster compromise.</p> <p>### Details The root cause of the vulnerability exists in [Common/Server/Utils/VM/VMRunner.ts](oneuptime/Common/Server/Utils/VM/VMRunner.ts) where user-supplied JavaScript is executed using `vm.runInContext()`:</p> <p>```typescript const vmPromise = vm.runInContext(script, sandbox, { ... }); ```</p> <p>The Node.js documentation explicitly warns that the `vm` module is not a security boundary and should never be used to run untrusted code.</p> <p>When a user creates a **Synthetic Monitor**, the code inputted into the Playwright script editor is passed directly to this backend function without any AST filtering or secure isolation (e.g., `isolated-vm` or a dedicated restricted container).</p> <p>An attacker can use the payload `const proc = this.constructor.constructor(&#39;return process&#39;)();` to step out of the sandbox context and grab the host&#39;s native `process` object. From there, th…</p> https://vulnerability.circl.lu/vuln/ghsa-h343-gg57-2q67