CVE-2026-27574: RCE in @oneuptime/common Node.js Monitor

The impact of CVE-2026-27574 is severe. The vulnerability stems from the way OneUptime allows users to define custom JavaScript monitors. These monitors are executed within Node.js using the vm module, which is explicitly documented by Node.js as unsuitable for running untrusted code. An attacker who can register an account can inject malicious JavaScript code into a monitor. This code then executes with the privileges of the OneUptime probe process, which has host networking access and holds all cluster credentials in its environment. This effectively grants the attacker complete control over the cluster, enabling them to steal sensitive data, modify configurations, and potentially pivot to other systems within the network. The attack pattern mirrors scenarios where untrusted code execution within a containerized environment leads to complete container breakout and host compromise.

1. Reserved2026-02-20
2. Published2026-02-24
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-27574 is to immediately upgrade to version 10.0.0 or later of the @oneuptime/common package. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter input validation and sanitization for any user-supplied JavaScript code used in monitors. While not a complete solution, this can reduce the attack surface. Review existing monitors for any suspicious or unusual code. Consider implementing a Web Application Firewall (WAF) with rules to detect and block malicious JavaScript payloads targeting the monitor execution endpoint. Monitor system logs for unusual process activity or unexpected network connections originating from the OneUptime probe process. After upgrading, confirm the fix by attempting to execute a known malicious payload within a monitor and verifying that it is blocked or fails to execute.