The vulnerability resides in OneUptime's synthetic monitoring feature, which permits low‑privileged project users to submit arbitrary Playwright scripts that are executed on the probe service. The code runs inside a Node.js vm context but is passed live host Playwright objects such as browser and page. Because the trusted vm does not sandbox these objects, an attacker can invoke browser.browserType().launch(...) from the injected script to spawn arbitrary processes on the probe host or container. This capability constitutes server‑side remote code execution. The weakness is represented by CWE‑749, indicating a trusted library used with untrusted data.

The affected vendor is OneUptime (product OneUptime), and the risk applies to all installations of OneUptime prior to version 10.0.20. The synthetic monitors are enabled by default in these versions, and any user with low privileges who can add or edit a monitor may inject malicious code. The patch introduces a restriction that prevents untrusted scripts from accessing host‑level Playwright objects.

The CVSS score of 10 highlights maximum severity, though the EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalogue, indicating limited public exploitation evidence to date. Nevertheless, the attack path requires only a low‑privileged user to submit a monitor script, which is a reasonable threat in environments where such users are plentiful. Modern patch management processes should treat this as critical and prioritize upgrading to version 10.0.20. Failure to patch could allow an attacker to execute arbitrary code on the host, compromising confidentiality, integrity, and availability of the monitoring infrastructure.