{"action":"Upgrade uptime-kuma to 1.22.1 or later.","affected":[{"fixed":"1.22.1","introduced":"0"}],"component":"uptime-kuma","cve_ids":["CVE-2023-36821"],"ecosystem":"npm","epss":0.02017,"exploited":false,"fixed_versions":["1.22.1"],"ghsa_id":"GHSA-7grx-f945-mj96","id":"tcs_01M5KFA2CANYX6QWA08YFCGH1T","modified_at":"2026-09-10T03:50:13.391026492Z","published_at":"2024-05-01T10:01:24Z","references":["https://osv.dev/vulnerability/GHSA-7grx-f945-mj96","https://github.com/louislam/uptime-kuma/security/advisories/GHSA-7grx-f945-mj96","https://nvd.nist.gov/vuln/detail/CVE-2023-36821","https://github.com/louislam/uptime-kuma/pull/3346","https://github.com/louislam/uptime-kuma/commit/a0736e04b2838aae198c2110db244eab6f87757b","https://github.com/louislam/uptime-kuma","https://github.com/louislam/uptime-kuma/blob/8c60e902e1c76ecbbd1b0423b07ce615341cb850/server/plugins-manager.js#L210-L216","https://github.com/louislam/uptime-kuma/releases/tag/1.22.1"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-7grx-f945-mj96","url":"https://osv.dev/vulnerability/GHSA-7grx-f945-mj96"}],"summary":"Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation"}