CVE-2026-30957: OneUptime @oneuptime/common Package Remote Code Execution Vulnerability
Summary
CVE-2026-30957: OneUptime has Synthetic Monitor RCE via exposed Playwright browser object. Affects @oneuptime/common versions < 10.0.21. Fixed in 10.0.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OneUptime is a platform that provides monitoring solutions for web applications, including Synthetic Monitors that allow users to simulate user interactions. The @oneuptime/common package is a core component of this platform, facilitating various functionalities. However, it has been found to have a critical vulnerability that allows low-privileged authenticated users to execute arbitrary commands on the server, posing significant security risks.
Vulnerability Detail
The vulnerability arises from the execution of untrusted Synthetic Monitor code within Node's virtual machine (vm) environment, where live Playwright browser and page objects are exposed. This design flaw allows a malicious user to leverage Playwright APIs to execute arbitrary commands on the server. The issue is classified as server-side remote code execution (RCE) and does not require escaping the vm sandbox. Attackers can exploit this vulnerability to run commands that could compromise the server's integrity and access sensitive information.
How To Fix
Latest published version: 14.0.85 as of 23 Oct 2026
npm install @oneuptime/common@14.0.85Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.0.21
This is the first release that contains the fix.
npm install @oneuptime/common@10.0.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Synthetic Monitor feature to trusted users only. Additionally, consider disabling the execution of custom code in Synthetic Monitors until the package is updated.
Conclusion
The CVE-2026-30957 vulnerability in the @oneuptime/common package poses a significant risk of remote code execution. It is crucial for users to update to the patched version 10.0.21 to mitigate this risk. Implementing temporary workarounds can help protect against potential exploits until the update is applied.
See every vulnerability recorded for @oneuptime/common →
FAQ
CVE-2026-30957 is a critical vulnerability in the @oneuptime/common package that allows remote code execution through exposed Playwright objects in Synthetic Monitors.
Any OneUptime deployment where an attacker can obtain ordinary project membership is affected, especially if the probe has access to sensitive internal services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, restrict access to the Synthetic Monitor feature and disable custom code execution as a temporary measure.
The CVSS score of this vulnerability is 9.9, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for @oneuptime/common.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
