The vulnerability lies in the custom JavaScript monitor feature of OneUptime versions 9.5.13 and earlier. It uses Node.js's node:vm module, a known insecure sandbox, to execute user‑supplied code. A simple one‑line payload can escape this sandbox and gain full access to the underlying process, allowing an attacker to run arbitrary code on the host in about half a minute.

Affected vendor is OneUptime. The issue applies to any deployment running version 9.5.13 or older. Version 10.0.5 and newer contain the fix.

The CVSS score is 10, indicating maximum severity, while the EPSS score of less than 1% points to a low but measurable exploitation probability. The vulnerability is not yet listed in the CISA KEV catalog. An attacker with a ProjectMember role—or any anonymous user if open registration is enabled—can create a custom JavaScript monitor, submit the escape payload, and execute arbitrary code on the cluster with credentials to all internal services, thereby achieving full cluster compromise.