CVEvulnerability

CVE-2026-33396

9.9 CRITICAL Published 2026-03-26 Modified 2026-10-07 Official page ↗
Status
Analyzed
Published
2026-03-26
Last modified
2026-10-07
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-184, CWE-693, CWE-78

Description

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMember) can achieve remote command execution on the Probe container/host by abusing Synthetic Monitor Playwright script execution. Synthetic monitor code is executed in VMRunner.runCodeInNodeVM with a live Playwright page object in context. The sandbox relies on a denylist of blocked properties/methods, but it is incomplete. Specifically, _browserType and launchServer are not blocked, so attacker code can traverse `page.context().browser()._browserType.launchServer(...)` and spawn arbitrary processes. Version 10.0.35 contains a patch.

Affected configurations

• hackerbay oneuptime (< 10.0.35)

Related

Weakness · CWE (3)

  • CWE-184 Incomplete List of Disallowed Inputs weakness
  • CWE-693 Protection Mechanism Failure weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References