CVE-2026-33396: OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMember) can achieve remote command execution on the Probe container/host by abusing Synthetic Monitor Playwright script execution. Synthetic monitor code is executed in VMRunner.runCodeInNodeVM with a live Playwright page object in context. The sandbox relies on a denylist of blocked properties/methods, but it is incomplete. Specifically, browserType and launchServer are not blocked, so attacker code can traverse page.context().browser().browserType.launchServer(...) and spawn arbitrary processes. Version 10.0.35 contains a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OneUptimeto a version that resolves this vulnerability.Fixed in 10.0.35
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33396?
CVE-2026-33396 has a moderate severity level due to its potential to allow arbitrary command execution by low-privileged authenticated users.
How do I fix CVE-2026-33396?
To fix CVE-2026-33396, upgrade OneUptime to version 10.0.35 or later.
Who is affected by CVE-2026-33396?
CVE-2026-33396 affects low-privileged authenticated users within OneUptime versions before 10.0.35.
What can be exploited in CVE-2026-33396?
CVE-2026-33396 can be exploited to achieve remote command execution through a sandbox escape in the Synthetic Monitor Playwright runtime.
When was CVE-2026-33396 disclosed?
CVE-2026-33396 was disclosed in the security advisory related to the OneUptime platform.