CVE-2026-30921

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.20, OneUptime Synthetic Monitors allow low-privileged project users to submit custom Playwright code that is executed on the oneuptime-probe service. In the current implementation, this untrusted code is run inside Node's vm and is given live host Playwright objects such as browser and page. This creates a distinct server-side RCE primitive: the attacker does not need the classic this.constructor.constructor(...) sandbox escape. Instead, the attacker can directly use the injected Playwright browser object to reach browser.browserType().launch(...) and spawn an arbitrary executable on the probe host/container. This vulnerability is fixed in 10.0.20.

• CWE-749

• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-4j36-39gm-8vq8Exploit, Vendor Advisory

Published

Mar 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30915SFTPGo is an open source, event-driven file transfer solutio…4.3
• CVE-2026-30916Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-30917Bucket is a MediaWiki extension to store and retrieve struct…8.8
• CVE-2026-30918facileManager is a modular suite of web apps built with the …6.1
• CVE-2026-30919facileManager is a modular suite of web apps built with the …5.4
• CVE-2026-30920OneUptime is a solution for monitoring and managing online s…8.6
• CVE-2026-30922pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3…7.5
• CVE-2026-30923ModSecurity is an open source, cross platform web applicatio…7.5
• CVE-2026-30924qui is a web interface for managing qBittorrent instances. V…9.6
• CVE-2026-30925Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-30926SiYuan is a personal knowledge management system. Prior to 3…7.1
• CVE-2026-30927Admidio is an open-source user management solution. Prior to…5.4