OneUptime versions before 10.0.18 allow the execution of untrusted JavaScript code submitted by project members through Synthetic Monitors. The code is run inside the Node.js vm module without proper sandboxing, enabling a standard prototype‑chain escape to gain access to the Node.js process. This flaw is a classic instance of unsandboxed code execution (CWE‑94). An attacker who can create or modify a synthetic monitor can therefore run arbitrary system commands on the oneuptime‑probe container and, because the probe stores database credentials in its environment, can achieve a complete compromise of the entire cluster.

The affected product is OneUptime, specifically all installations of the OneUptime application released prior to version 10.0.18. These versions run the probe module that hosts the vulnerable String.prototype constructor escape logic. No other vendors or products are known to be affected.

The CVSS score of 10 reflects a high severity vulnerability with full local and remote privileges once the code is executed. The EPSS score of less than 1% indicates that the exploitation probability is very low at present, yet the possibility of the flaw remaining undiscovered and the impact of a successful exploit—complete cluster compromise—manifests a high overall risk. This vulnerability is not listed in the CISA KEV catalog. Attackers would most likely exploit it by creating or editing a synthetic monitor as a project member with code execution permissions; no additional external interaction is required once the user’s code is submitted.