CVE-2026-45102CWE-693

OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion

Critical · published May 27, 2026

CVSS v3.1
9.9
EPSS
0%
Percentile
40.4
In the wild
Unconfirmed
What it is

OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API was not designed for that and can be escaped via error objects and infinite recursion. This vulnerability is fixed in 10.0.98.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00479 · 40.4th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-05-27T18:50Z
EPSS history
Timeline
  • 27 MAY 18:50Z
    OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion
    cvelistv5