CVE-2026-27574

CVE-2026-27574 is a critical remote code execution (RCE) vulnerability affecting OneUptime versions 9.5.13 and below. The flaw stems from the custom JavaScript monitor feature, which improperly uses Node.js's node:vm module, allowing for trivial sandbox escape and full access to the underlying process. This enables an unauthenticated attacker, even with the lowest role, to achieve full cluster compromise within approximately 30 seconds due to the probe running with host networking and holding sensitive credentials. The vulnerability has a CVSS score of 9.9 (CRITICAL) due to its network attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed on the CISA KEV or Hot List, though it has received some community discussion.