CVE-2026-45102
BaseFortify
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oneuptime | oneuptime | to 10.0.98 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-693 | The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-45102 is a critical remote code execution vulnerability that can lead to the compromise of confidentiality, integrity, and availability of the affected system.
Such a compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity.
If exploited, this vulnerability could result in unauthorized access to sensitive information, potentially violating data protection requirements and leading to regulatory penalties.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the version of OneUptime installed on your system. Versions prior to 10.0.98 are vulnerable.
Since the exploit involves creating a malicious synthetic monitor using Playwright code that leverages prototype pollution for remote code execution, detection can involve monitoring for unusual or unauthorized synthetic monitors or Playwright scripts in the OneUptime dashboard.
No specific detection commands are provided in the available resources.
Can you explain this vulnerability to me?
This vulnerability affects OneUptime, an open-source monitoring and observability platform. Before version 10.0.98, OneUptime used the Node.js vm module as an isolation primitive. However, this module was not designed for secure isolation and can be escaped by exploiting error objects and infinite recursion.
How can this vulnerability impact me? :
The vulnerability has a very high severity with a CVSS base score of 9.9, indicating it can be exploited remotely with low complexity and no user interaction. It can lead to complete compromise of confidentiality, integrity, and availability, meaning an attacker could potentially execute arbitrary code, access sensitive data, or disrupt services.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade OneUptime to version 10.0.98 or later, as this version contains the fix for the issue involving the Node.js vm module isolation escape.