The vulnerability arises from the misuse of the Node.js vm module as an isolation primitive in OneUptime. The module was not designed for this use and can be escaped through error objects and infinite recursion, allowing an attacker to execute arbitrary code on the host. The weakness falls under CWE‑693, and the outcome is a remote code execution that compromises confidentiality, integrity, and availability of the affected system.

OneUptime (open‑source monitoring and observability platform) is impacted. All deployments running a version prior to 10.0.98 are vulnerable. The fix is incorporated in release 10.0.98 and later.

The CVSS score of 9.9 indicates a very high severity. The EPSS value is unavailable, so the precise exploitation probability cannot be quantified, but the lack of KEV listing suggests no widespread active exploitation yet. Nevertheless, because the flaw permits arbitrary code execution, it can be exploited over the network if the attacker can invoke a vulnerable execution path. The attack likely requires crafting input that triggers an error object or causes stack overflows through infinite recursion, which could be achieved via API calls or UI interactions.