CVE-2026-45102: OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion

Synopsis

A sandbox escape vulnerability in OneUptime, the open-source monitoring and observability platform, allows an authenticated attacker to break out of the Node.js vm module sandbox via crafted error objects and infinite recursion. The vulnerability is reachable over the network and requires only a low-privilege account; no victim interaction is needed. Successful exploitation gives the attacker full remote code execution on the host with high impact to confidentiality, integrity, and availability. Although the fix is available in version 10.0.98, no patched-image rebuild is currently listed; HarborGuard is tracking the advisory and will make a rebuild available as soon as an upstream fix image is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service is exposed over the network, so the attacker must be able to reach it via a standard network connection.

• AuthenticationRequired

  A low-privilege account is sufficient; any authenticated user of the OneUptime platform can trigger the sandbox escape.

• Victim interactionNot required

  No victim interaction is needed; the attacker can trigger the escape directly without social engineering or user participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker escapes the Node.js vm sandbox and executes arbitrary code in the context of the OneUptime server process.
• With high confidentiality impact, the attacker reads secrets, credentials, environment variables, and any monitoring data stored or in-flight on the host.
• With high integrity impact, the attacker modifies persisted monitoring configuration, incident records, and alert routing rules.
• With high availability impact and a Changed scope, the attacker crashes or destabilizes the OneUptime service and can affect other components sharing the same host or cluster node.