CVE-2026-27728: OS Command Injection in @oneuptime/common NetworkPathMonitor
Summary
CVE-2026-27728: An OS command injection vulnerability in NetworkPathMonitor.performTraceroute() allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters i... Affects @oneuptime/common versions < 10.0.7. Fixed in 10.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @oneuptime/common package is a component of the OneUptime platform, which provides monitoring and management solutions for web applications and services. It includes various utilities for network path monitoring, allowing users to track the performance and availability of network paths. However, a critical vulnerability has been identified in the NetworkPathMonitor class, which can lead to severe security risks if exploited.
Vulnerability Detail
An OS command injection vulnerability exists in the performTraceroute() method of the NetworkPathMonitor class. This vulnerability arises from the lack of input sanitization for the destination parameter, which is directly interpolated into a shell command string. As a result, an authenticated user can inject shell metacharacters, allowing arbitrary command execution on the Probe server. This could lead to remote code execution, unauthorized access to sensitive files, and potential compromise of other tenants' data in a multi-tenant environment.
How To Fix
Latest published version: 14.0.85 as of 23 Oct 2026
npm install @oneuptime/common@14.0.85Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.0.7
This is the first release that contains the fix.
npm install @oneuptime/common@10.0.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the NetworkPathMonitor class until the package is updated. Additionally, ensure that only trusted users have access to create or edit network path monitors to minimize the risk of exploitation.
Conclusion
The OS command injection vulnerability in the @oneuptime/common package's NetworkPathMonitor class poses significant risks to users. It is crucial to update to the patched version to mitigate these risks and ensure the security of your applications.
See every vulnerability recorded for @oneuptime/common →
FAQ
The vulnerability is an OS command injection that allows authenticated users to execute arbitrary commands on the server.
Any authenticated user with the ability to create or edit a network path monitor in a OneUptime project is affected.
The impacts include remote code execution, unauthorized access to sensitive files, and the ability to compromise other tenants' monitoring data.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
The CVSS score of this vulnerability is 9.9, indicating a critical severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @oneuptime/common.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
