CVE-2026-27574 — AI Deep Analysis Summary

🚨 **Essence**: OneUptime ≤ v9.5.13 suffers from **Code Injection** via the insecure `node:vm` module in Custom JavaScript monitoring. 📉 **Consequences**: Sandbox escape leading to **Full Cluster Compromise** (RCE).

🛡️ **Root Cause**: **CWE-94** (Code Injection). The flaw lies in using an unsafe `node:vm` module to execute user-supplied JavaScript code without proper isolation. ⚠️

🎯 **Affected**: **OneUptime** versions **9.5.13 and earlier**. Specifically the **Custom JavaScript Monitoring** feature. 📦

💀 **Attacker Capabilities**: Gains **High Privileges**. Can escape the sandbox, execute arbitrary code, and achieve **Complete Cluster Break-in**. Data integrity & availability are at risk. 🔓

🔑 **Exploitation Threshold**: **Low**. Requires **Low Privileges** (PR:L) and **Low Complexity** (AC:L). No User Interaction (UI:N) needed. Network accessible (AV:N). 🌐

🔍 **Public Exploit**: **Yes**. A PoC is available on GitHub: `mbanyamer/CVE-2026-27574-OneUptime-RCE`. Wild exploitation is possible. 💣

🔎 **Self-Check**: Scan for **OneUptime** instances running version **≤ 9.5.13**. Check if **Custom JavaScript Monitoring** is enabled. Look for `node:vm` usage in the codebase. 🧐

🩹 **Official Fix**: **Yes**. Patched in commit `7f9ed4d43945574702a26b7c206e38cc344fe427`. Update immediately! ✅

🚧 **No Patch Workaround**: Disable **Custom JavaScript Monitoring** feature entirely. Restrict network access to the monitoring interface. Isolate the cluster. 🛑

⚡ **Urgency**: **CRITICAL**. CVSS Score is **High** (implied by H/H/H). Active PoC exists. Patch **IMMEDIATELY** to prevent cluster takeover. 🚨