OneUptime vm Module Escape via Error Objects and Recursion

Compliance Impact

CVE-2026-45102 is a critical remote code execution vulnerability that can lead to the compromise of confidentiality, integrity, and availability of the affected system.

Such a compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity.

If exploited, this vulnerability could result in unauthorized access to sensitive information, potentially violating data protection requirements and leading to regulatory penalties.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects OneUptime, an open-source monitoring and observability platform. Before version 10.0.98, OneUptime used the Node.js vm module as an isolation primitive. However, this module was not designed for secure isolation and can be escaped by exploiting error objects and infinite recursion.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability has a very high severity with a CVSS base score of 9.9, indicating it can be exploited remotely with low complexity and no user interaction. It can lead to complete compromise of confidentiality, integrity, and availability, meaning an attacker could potentially execute arbitrary code, access sensitive data, or disrupt services.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade OneUptime to version 10.0.98 or later, as this version contains the fix for the issue involving the Node.js vm module isolation escape.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the version of OneUptime installed on your system. Versions prior to 10.0.98 are vulnerable.

Since the exploit involves creating a malicious synthetic monitor using Playwright code that leverages prototype pollution for remote code execution, detection can involve monitoring for unusual or unauthorized synthetic monitors or Playwright scripts in the OneUptime dashboard.

No specific detection commands are provided in the available resources.

Useful 0 Not Useful 0