CVE-2026-30921 — AI Deep Analysis Summary

🚨 **Essence**: Low-privilege users can inject custom **Playwright code** in OneUptime < 10.0.20. 💥 **Consequence**: Leads to **Server-Side Remote Code Execution (RCE)**.…

🛡️ **Root Cause**: **CWE-749** (Improper Restriction of Exposed Operational Capabilities). The system fails to properly restrict operational capabilities, allowing dangerous code execution.

📦 **Affected**: **OneUptime** product. Specifically versions **prior to 10.0.20**. 🏢 **Vendor**: OneUptime.

💀 **Attacker Actions**: As a **low-privilege user**, you can execute arbitrary code on the server. 📊 **Impact**: Full control (C:H, I:H, A:H). Can steal data, modify systems, or crash services.

🔑 **Threshold**: **Low**. Requires **PR:L** (Low Privileges). No UI interaction needed (UI:N). Network accessible (AV:N). Easy to exploit if you have a basic account.

🕵️ **Public Exploit**: **No**. The `pocs` array is empty. No public PoC or wild exploitation code is currently available in the data.

🔍 **Self-Check**: Check your OneUptime version. If it is **< 10.0.20**, you are vulnerable. Look for features allowing **custom Playwright code** submission by low-privilege users.

✅ **Fixed**: **Yes**. Upgrade to **OneUptime 10.0.20** or later. 📝 **Reference**: [GitHub Advisory GHSA-4j36-39gm-8vq8](https://github.com/OneUptime/oneuptime/security/advisories/GHSA-4j36-39gm-8vq8).

🚧 **No Patch?**: Restrict access to Playwright features. Limit who can submit custom code. Apply network-level isolation. Monitor for unusual server processes.

⚡ **Urgency**: **HIGH**. CVSS Score is **9.8** (Critical). RCE via low privileges is a severe threat. Patch immediately! 🏃‍♂️💨