CVE-2026-45102: OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-27 · updated 2026-06-17
Weakness: CWE-693

Description

OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API was not designed for that and can be escaped via error objects and infinite recursion. This vulnerability is fixed in 10.0.98.

Affected products

oneuptime: before 10.0.98

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-g9cp-35m2-fjv6
https://github.com/OneUptime/oneuptime/security/advisories/GHSA-g9cp-35m2-fjv6

Get alerted when CVE-2026-45102 or the next vulnerability affects your stack