CVE-2026-45102

critical · 9.9

OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API was not designed for that and can be escaped via error objects and infinite recursion. This vulnerability is fixed in 10.0.98.

9.9

CVSS

0.3%

EPSS (exploit prob.)

19th

EPSS percentile

2026-05-27

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-693

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-g9cp-35m2-fjv6
https://github.com/OneUptime/oneuptime/security/advisories/GHSA-g9cp-35m2-fjv6

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-45102