CVE-2026-27728
OS Command Injection in OneUptime NetworkPathMonitor Allows Remote Code Execution
Publication date: 2026-02-25
Last updated on: 2026-03-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hackerbay | oneuptime | to 10.0.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-27728 is a critical OS command injection vulnerability in the OneUptime solution, specifically in the NetworkPathMonitor.performTraceroute() method. This vulnerability allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into the monitor's destination field."}, {'type': 'paragraph', 'content': "The issue arises because the method constructs a shell command string by directly interpolating an unsanitized, user-controlled destination parameter into traceroute or tracert commands, which are executed using Node.js's child_process.exec(). Since exec() spawns a shell, any shell metacharacters included in the destination string are interpreted by the shell, enabling arbitrary command execution."}, {'type': 'paragraph', 'content': 'A proof-of-concept demonstrated that injecting payloads like "127.0.0.1; id" or "127.0.0.1 | whoami" results in successful execution of arbitrary commands. The vulnerability affects the Probe server and can lead to unauthorized command execution by authenticated users.'}] [2]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can have severe impacts including remote code execution on the Probe server with the privileges of the Probe service user.'}, {'type': 'list_item', 'content': 'Unauthorized reading of sensitive files such as environment variables, credentials, and tokens.'}, {'type': 'list_item', 'content': "Lateral movement to internal services accessible from the Probe's network position."}, {'type': 'list_item', 'content': "Compromise of other tenants' monitoring data in multi-tenant SaaS deployments."}, {'type': 'list_item', 'content': 'Establishment of persistent backdoors such as reverse shells, cron jobs, or SSH keys.'}] [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking if the NetworkPathMonitor component is executing traceroute commands with unsanitized user input that includes shell metacharacters. A practical way to detect exploitation attempts is to monitor for traceroute or tracert commands with suspicious parameters containing shell metacharacters such as ;, |, $(), ``, &&, or ||.'}, {'type': 'paragraph', 'content': 'You can use system commands to look for running traceroute or tracert processes with suspicious arguments or check logs for such commands. For example, on Linux or macOS systems, you might run:'}, {'type': 'list_item', 'content': 'ps aux | grep traceroute'}, {'type': 'list_item', 'content': "grep -E 'traceroute.*[;|$`&]' /var/log/syslog"}, {'type': 'paragraph', 'content': 'On Windows systems, you can use:'}, {'type': 'list_item', 'content': "Get-Process tracert | Where-Object { $_.Path -match '[;|$`&]' }"}, {'type': 'paragraph', 'content': 'Additionally, reviewing the destination fields in network path monitors for suspicious input containing shell metacharacters can help detect attempts to exploit this vulnerability.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade OneUptime to version 10.0.7 or later, where the vulnerability is fixed by validating the destination input and replacing the use of exec with execFile to prevent shell command injection.
If upgrading is not immediately possible, restrict authenticated user permissions to prevent unauthorized creation or editing of network path monitors, as the vulnerability requires authenticated access.
Additionally, monitor and audit the Probe server for suspicious traceroute command executions and consider applying network-level controls to limit access to the Probe server.