10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27574

CVE-2026-27574: OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE

Summary

OneUptime lets project members write custom JavaScript that runs inside monitors. The problem is it executes that code using Node.js's built-in vm module, which Node.js itself documents as "not a security mechanism — do not use it to run untrusted code." The classic one-liner escape gives full access to the underlying process, and since the probe runs with host networking and holds all cluster credentials in its environment, this turns into a full cluster compromise for anyone who can register an account.

Details

The vulnerable code is in Common/Server/Utils/VM/VMRunner.ts at line 55:

vm.runInContext(script, sandbox, { timeout })

The JavaScript that reaches this call comes straight from the monitor's customCode field, which is only validated as Zod.string().optional() in Common/Types/Monitor/MonitorStep.ts:531. No AST analysis, no keyword filtering, nothing — just a string that goes directly into vm.runInContext().

Both CustomCodeMonitor.ts and SyntheticMonitor.ts import VMRunner directly inside the probe process. So when the probe picks up a monitor and runs it, the escape executes in the probe's own process — not a child process, not a container.

Two things make this especially bad:

First, the probe runs with network_mode: host (see docker-compose.base.yml:397) and carries ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, and CLICKHOUSE_PASSWORD as environment variables. Once you escape the sandbox you have all of those.

Second, the permission to create monitors is granted to Permission.ProjectMember — the lowest role — in Common/Models/DatabaseModels/Monitor.ts:46-51. There is no check that restricts Custom JavaScript Code monitors to admins only. And since open registration is on by default (disableSignup: false), any random person on the internet can reach this in about 30 seconds.

Miggo Vulnerability Database

→

CVE-2026-27574

CVE-2026-27574:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@oneuptime/common	npm	< 10.0.0	10.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the VMRunner.runCodeInSandbox function located in Common/Server/Utils/VM/VMRunner.ts. This function utilized the node:vm module to execute JavaScript code provided by users. The node:vm module is not designed as a security feature and is known to be vulnerable to sandbox escapes. The provided patch addresses this by replacing the insecure node:vm module with the isolated-vm package, which offers a more secure sandboxing environment. A key location where this vulnerable function was called is SyntheticMonitor.executeByBrowserAndScreenSize in Probe/Utils/Monitors/MonitorTypes/SyntheticMonitor.ts. This function has been updated to execute the code within an isolated child process, thereby mitigating the risk. The vulnerability permitted any user with project member permissions to run arbitrary code on the probe host, potentially leading to a complete compromise of the cluster.

Vulnerable functions

VMRunner.runCodeInSandbox

Common/Server/Utils/VM/VMRunner.ts

This function directly uses the `node:vm` module's `runInContext` method to execute user-provided JavaScript code. The `node:vm` module is not a security mechanism and is prone to sandbox escapes, allowing an attacker to gain access to the underlying Node.js process and execute arbitrary code.

SyntheticMonitor.executeByBrowserAndScreenSize

Probe/Utils/Monitors/MonitorTypes/SyntheticMonitor.ts

This function was responsible for calling the vulnerable `VMRunner.runCodeInSandbox` with user-provided code from a synthetic monitor, acting as a trigger for the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

10

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-27574: OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE

Summary

Details

CVE-2026-27574:

10

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

10

10

Technical Details

CVE-2026-27574: OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE

Summary

Details

PoC

Impact

10

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-27574: OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE

Summary

Details

CVE-2026-27574:

10

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

10

10

Technical Details

CVE-2026-27574: OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE

Summary

Details

PoC

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI