CVE-2026-27728
CVE-2026-27728 · OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in `NetworkPathMonitor.performTraceroute()` allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into a monitor's destination field. Version 10.0.7 fixes the vulnerability.
CVSS 10.0 · Critical · EPSS 2.0% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
oneuptime
- Versions
- < 10.0.7: Affected
No fix published
@oneuptime/common npm
- Affected ranges
- SEMVER: < 10.0.7
Update to 10.0.7