Affected OneUptime Synthetic Monitors allowed a user with low‑privileged authenticated project access to run arbitrary commands on the probe server. Untrusted monitor scripts were executed inside Node’s vm while live Playwright browser and page objects were exposed, letting a malicious user call browser APIs to launch attacker‑controlled executables. This is a CWE‑749 flaw and allows server‑side remote code execution on the probe host without needing a separate VM sandbox escape.

All installations of OneUptime before version 10.0.21 are impacted, including the open‑source distribution identified by the CPE hackerbay:oneuptime. Users deploying OneUptime Synthetic Monitoring features should verify their running version and consider it vulnerable if it is earlier than 10.0.21.

The CVSS score of 10 signals maximum severity, but the exploit probability is low with an EPSS score below 1%. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation incidents have been reported yet. Attackers would need to be an authenticated, low‑privileged project user, which means an insider or compromised account could exploit this flaw. Due to the reliance on exposed Playwright objects, it could be used to compromise the probe host and potentially the wider network if lateral movement is possible.