npm/@oneuptime/common CVE-2026-30921: critical 9.9, EPSS 0.54%

OneUptime: Synthetic Monitor RCE via exposed Playwright browser object

Action: Upgrade @oneuptime/common to 10.0.20 or later.

npm i @oneuptime/common@10.0.20

Affected

Fixed versions

Sources

• osv: GHSA-4j36-39gm-8vq8
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-4j36-39gm-8vq8
• https://nvd.nist.gov/vuln/detail/CVE-2026-30921
• https://github.com/OneUptime/oneuptime
• https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/App/FeatureSet/Dashboard/src/Components/Form/Monitor/MonitorStep.tsx#L861-L918
• https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/App/FeatureSet/Dashboard/src/Components/Form/Monitor/MonitorTest.tsx#L66-L84
• https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Common/Models/DatabaseModels/Monitor.ts#L45-L78
• https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Common/Models/DatabaseModels/MonitorTest.ts#L27-L60
• https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Common/Server/Utils/VM/VMRunner.ts#L323-L405
• https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Probe/Jobs/Monitor/FetchList.ts#L110-L121
• https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Probe/Jobs/Monitor/FetchMonitorTest.ts#L55-L85
• https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Probe/Utils/Monitors/Monitor.ts#L323-L338
• https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Probe/Utils/Monitors/MonitorTypes/SyntheticMonitor.ts#L156-L168

CVE-2026-30921 · published 2026-03-07T02:39:04Z · modified 2026-03-10T19:01:33.257681Z · JSON