{"action":"Upgrade @oneuptime/common to 10.0.20 or later.","affected":[{"fixed":"10.0.20","introduced":"0"}],"component":"@oneuptime/common","cve_ids":["CVE-2026-30921"],"ecosystem":"npm","epss":0.00538,"exploited":false,"fixed_versions":["10.0.20"],"ghsa_id":"GHSA-4j36-39gm-8vq8","id":"tcs_01M5KF0NRY9XBGYBW0M4FX5FWR","modified_at":"2026-03-10T19:01:33.257681Z","published_at":"2026-03-07T02:39:04Z","references":["https://osv.dev/vulnerability/GHSA-4j36-39gm-8vq8","https://github.com/OneUptime/oneuptime/security/advisories/GHSA-4j36-39gm-8vq8","https://nvd.nist.gov/vuln/detail/CVE-2026-30921","https://github.com/OneUptime/oneuptime","https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/App/FeatureSet/Dashboard/src/Components/Form/Monitor/MonitorStep.tsx#L861-L918","https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/App/FeatureSet/Dashboard/src/Components/Form/Monitor/MonitorTest.tsx#L66-L84","https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Common/Models/DatabaseModels/Monitor.ts#L45-L78","https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Common/Models/DatabaseModels/MonitorTest.ts#L27-L60","https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Common/Server/Utils/VM/VMRunner.ts#L323-L405","https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Probe/Jobs/Monitor/FetchList.ts#L110-L121","https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Probe/Jobs/Monitor/FetchMonitorTest.ts#L55-L85","https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Probe/Utils/Monitors/Monitor.ts#L323-L338","https://github.com/OneUptime/oneuptime/blob/8e90f451426b160718bdd1796b68c5ec15318101/Probe/Utils/Monitors/MonitorTypes/SyntheticMonitor.ts#L156-L168"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-4j36-39gm-8vq8","url":"https://osv.dev/vulnerability/GHSA-4j36-39gm-8vq8"}],"summary":"OneUptime: Synthetic Monitor RCE via exposed Playwright browser object"}