The vulnerability is a sandbox escape in the Synthetic Monitor Playwright runtime of OneUptime. A low‑privileged authenticated user with a ProjectMember role can run arbitrary JavaScript that accesses unblocked Playwright APIs to spawn processes on the Probe container or host. The flaw is due to an incomplete deny‑list, allowing code such as page.context().browser()._browserType.launchServer(...). This enables full control of the probe environment and results in remote command execution.

Vulnerable installations are running OneUptime versions prior to 10.0.35. Any deployment that has the synthetic monitor feature enabled can be affected. The affected product is OneUptime OneUptime.

With a CVSS score of 10, the vulnerability is considered critical. The attacker must be authenticated as a ProjectMember, a role that can create or modify synthetic monitors. Once a malicious script is executed, the attacker can run arbitrary commands on the Probe or host. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified. The vulnerability is not yet listed in the CISA KEV catalog.