What’s Vulnerable › Vulnerabilities

CVE-2026-33396: OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-26 · updated 2026-10-07
• Weakness: CWE-78

Description

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMember) can achieve remote command execution on the Probe container/host by abusing Synthetic Monitor Playwright script execution. Synthetic monitor code is executed in VMRunner.runCodeInNodeVM with a live Playwright page object in context. The sandbox relies on a denylist of blocked properties/methods, but it is incomplete. Specifically, _browserType and launchServer are not blocked, so attacker code can traverse `page.context().browser()._browserType.launchServer(...)` and spawn arbitrary processes. Version 10.0.35 contains a patch.

Affected products

• oneuptime: before 10.0.35 — fixed in 10.0.35

How to fix

Upgrade to a fixed version: oneuptime 10.0.35. Check the vendor advisory for mitigations.

References

• https://github.com/OneUptime/oneuptime/commit/e8e4ee3ff0740eb131045ab3d67453141c46178a
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cqpg-phpp-9jjg
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cqpg-phpp-9jjg

Get alerted when CVE-2026-33396 or the next vulnerability affects your stack