PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45102 OneUptime CVE debrief

OneUptime, an open-source monitoring and observability platform, contains a critical sandbox escape vulnerability in versions prior to 10.0.98. The platform uses Node.js's `vm` module as an isolation primitive for executing untrusted code. However, the `vm` module was not designed for secure isolation and can be escaped through manipulation of error objects and infinite recursion techniques. Successful exploitation allows an attacker with low privileges to break out of the sandboxed environment, potentially achieving complete compromise of the host system with high impact to confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and changed scope—resulting in a critical 9.9 score. This vulnerability was disclosed on May 27, 2026, with a fix released in version 10.0.98. Organizations running OneUptime should prioritize upgrading to the patched version, as the `vm` module's architectural limitations make this class of vulnerability particularly dangerous for multi-tenant or externally-facing deployments.

Vendor
OneUptime
Product
Unknown
CVSS
CRITICAL 9.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-01
Advisory published
2026-05-27
Advisory updated
2026-06-01

Who should care

Organizations running OneUptime instances, particularly those with multi-tenant deployments, external user access, or integrations executing user-supplied code. DevOps teams, security engineers, and platform operators responsible for observability infrastructure should prioritize this patch.

Technical summary

The Node.js `vm` module provides a V8 virtual machine context for executing JavaScript code, but lacks the security boundaries required for untrusted code isolation. Attackers can exploit error object prototypes and infinite recursion to access the host context's global object, escaping the sandbox. This is a known architectural limitation of the `vm` module, which the Node.js documentation explicitly warns against using for untrusted code. OneUptime's use of this module for isolation prior to 10.0.98 created a critical attack surface.

Defensive priority

critical

Recommended defensive actions

  • Upgrade OneUptime to version 10.0.98 or later immediately
  • Audit any custom scripts or integrations using OneUptime's sandboxed execution features for signs of compromise
  • Consider implementing additional defense-in-depth controls such as container isolation or separate process boundaries for untrusted code execution
  • Review access controls to limit who can submit code for sandboxed execution
  • Monitor for anomalous process behavior or unexpected outbound connections from OneUptime instances

Evidence notes

Vulnerability confirmed through GitHub Security Advisory GHSA-g9cp-35m2-fjv6. CWE-693 (Protection Mechanism Failure) classified. Fix version 10.0.98 explicitly stated in advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45102 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45102

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45102 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45102

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.