9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27728

CVE-2026-27728: OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in NetworkPathMonitor.performTraceroute() allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into a monitor's destination field. Version 10.0.7 fixes the vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27728

CVE-2026-27728:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@oneuptime/common	npm	< 10.0.7	10.0.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic OS command injection within the NetworkPathMonitor.performTraceroute function in Probe/Utils/Monitors/MonitorTypes/NetworkPathMonitor.ts. The provided vulnerability description and the patch clearly indicate that the destination parameter, which can be controlled by an authenticated user, was directly interpolated into a command string. This string was then executed using child_process.exec, which is known to be vulnerable to command injection if its input is not sanitized because it invokes a shell (/bin/sh). The patch addresses this vulnerability in two ways: first, by replacing the unsafe exec with execFile, which does not spawn a shell and treats arguments as a list, preventing injection. Second, it adds a validation function, isValidDestination, to ensure the destination is a valid hostname or IP address before it is used. The vulnerable function that would appear in a runtime profile during exploitation is NetworkPathMonitor.performTraceroute, as it is the function that directly constructs and executes the malicious command.

Vulnerable functions

NetworkPathMonitor.performTraceroute

Probe/Utils/Monitors/MonitorTypes/NetworkPathMonitor.ts

The `performTraceroute` function was vulnerable to OS command injection. It constructed a shell command by directly concatenating the unsanitized `destination` parameter, which is user-controllable. This command was then executed using `child_process.exec`, which spawns a shell, allowing shell metacharacters in the `destination` to be interpreted, leading to arbitrary command execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.