VulnerabilityDeferred

CVE-2026-45102

This vulnerability is fixed in 10.0.98.

CRITICAL 9.9EPSS 0.27%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.27%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API was not designed for that and can be escaped via error objects and infinite recursion. This vulnerability is fixed in 10.0.98.

CVSS 3.1: 9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.27% probability · 19th percentile
CISA KEV: Not listed
Weakness: CWE-693
Source: security-advisories@github.com

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-g9cp-35m2-fjv6
https://github.com/OneUptime/oneuptime/security/advisories/GHSA-g9cp-35m2-fjv6

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.