CVE-2026-33396 Code injection in oneuptime
Low-privileged users can execute arbitrary commands on the Probe host by bypassing the Playwright sandbox in OneUptime Synthetic Monitors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33396?
CVE-2026-33396 is a critical code injection vulnerability in oneuptime, published on 26 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMember) can achieve remote command execution on the Probe container/host by abusing Synthetic Monitor Playwright script execution. Synthetic monitor code is executed in VMRunner.runCodeInNodeVM with a live Playwright page object in context. The sandbox relies on a denylist of blocked properties/methods, but it is incomplete. Specifically, _browserType and launchServer are not blocked, so attacker code can traverse `page.context().browser()._browserType.launchServer(...)` and spawn arbitrary processes. Version 10.0.35 contains a patch.
Which versions are affected by CVE-2026-33396?
It affects 1 product.
Products include Hackerbay Oneuptime.
How do I fix CVE-2026-33396?
No fix has been published for CVE-2026-33396 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-33396 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33396 exists.
Other vulnerabilities in oneuptime
- CVE-2026-32306 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
- CVE-2026-30956 OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header
- CVE-2026-30957 OneUptime Synthetic Monitor RCE via exposed Playwright browser object
- CVE-2026-30887 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
- CVE-2026-30921 OneUptime Synthetic Monitor RCE via exposed Playwright browser object
Sources
Also known as GHSA-cqpg-phpp-9jjg.