This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: OneUptime โค v9.5.13 suffers from **Code Injection** via the insecure `node:vm` module in Custom JavaScript monitoring. ๐ **Consequences**: Sandbox escape leading to **Full Cluster Compromise** (RCE).
Q2Root Cause? (CWE/Flaw)
๐ก๏ธ **Root Cause**: **CWE-94** (Code Injection). The flaw lies in using an unsafe `node:vm` module to execute user-supplied JavaScript code without proper isolation. โ ๏ธ
Q3Who is affected? (Versions/Components)
๐ฏ **Affected**: **OneUptime** versions **9.5.13 and earlier**. Specifically the **Custom JavaScript Monitoring** feature. ๐ฆ
Q4What can hackers do? (Privileges/Data)
๐ **Attacker Capabilities**: Gains **High Privileges**. Can escape the sandbox, execute arbitrary code, and achieve **Complete Cluster Break-in**. Data integrity & availability are at risk. ๐
Q5Is exploitation threshold high? (Auth/Config)
๐ **Exploitation Threshold**: **Low**. Requires **Low Privileges** (PR:L) and **Low Complexity** (AC:L). No User Interaction (UI:N) needed. Network accessible (AV:N). ๐
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ **Public Exploit**: **Yes**. A PoC is available on GitHub: `mbanyamer/CVE-2026-27574-OneUptime-RCE`. Wild exploitation is possible. ๐ฃ
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for **OneUptime** instances running version **โค 9.5.13**. Check if **Custom JavaScript Monitoring** is enabled. Look for `node:vm` usage in the codebase. ๐ง