CVE-2026-30957

The Synthetic Monitors mechanism executes untrusted user code within a Node.js sandbox environment (vm module), however browser objects and Playwright page instances running in the host context are directly exposed to this code. An attacker can invoke Playwright API methods on the injected browser object, causing the probe server to execute an executable file controlled by the attacker. The attack does not require separate vm sandbox escape — it only requires exploitation of available host objects.

An attacker can execute arbitrary system commands on the oneuptime-probe server or container, potentially leading to full compromise of the probe environment, data exfiltration, and further lateral movement within the infrastructure.

OneUptime should be updated to version 10.0.21 or later, where the vulnerability has been fixed. The patch is available in the official GitHub repository: https://github.com/OneUptime/oneuptime/releases/tag/10.0.21

OneUptime (Hackerbay) in all versions before 10.0.21, particularly installations using the Synthetic Monitors functionality.