npm/@oneuptime/common CVE-2026-30957: critical 9.9, EPSS 1.20%

OneUptime has Synthetic Monitor RCE via exposed Playwright browser object

Action: Upgrade @oneuptime/common to 10.0.21 or later.

npm i @oneuptime/common@10.0.21

Affected

Fixed versions

Sources

• osv: GHSA-jw8q-gjvg-8w4q
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-jw8q-gjvg-8w4q
• https://nvd.nist.gov/vuln/detail/CVE-2026-30957
• https://github.com/OneUptime/oneuptime
• https://github.com/OneUptime/oneuptime/releases/tag/10.0.21

CVE-2026-30957 · published 2026-03-10T01:12:59Z · modified 2026-03-10T19:01:29.532205Z · JSON