npm/oneuptime CVE-2026-32306: critical 9.9, EPSS 0.66%

OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

Action: Upgrade oneuptime to 10.0.23 or later.

npm i oneuptime@10.0.23

Affected

Fixed versions

Sources

• osv: GHSA-p5g2-jm85-8g35
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-p5g2-jm85-8g35
• https://nvd.nist.gov/vuln/detail/CVE-2026-32306
• https://github.com/OneUptime/oneuptime
• https://github.com/OneUptime/oneuptime/releases/tag/10.0.23

CVE-2026-32306 · published 2026-03-13T20:00:34Z · modified 2026-03-16T17:16:25.316450Z · JSON