Attack Chain

1. A low-privileged user authenticates to the OneUptime platform as a ProjectMember.
2. The attacker accesses the Synthetic Monitor feature.
3. The attacker creates or modifies a synthetic monitor, injecting malicious JavaScript code within the Playwright script execution context.
4. The malicious script utilizes the page.context().browser() object to access the internal Playwright browser instance.
5. The script leverages the non-blocked _browserType property to gain access to browser management functionalities.
6. The script calls the launchServer() method via page.context().browser()._browserType.launchServer(...) to spawn a new process.
7. The attacker specifies an arbitrary command to be executed by the spawned process, bypassing the intended sandbox restrictions.
8. The arbitrary command executes on the Probe container/host, resulting in remote command execution.

Impact

Successful exploitation of CVE-2026-33396 grants attackers the ability to execute arbitrary commands on the OneUptime Probe container or host. The observed damage includes unauthorized access to sensitive data, modification of system configurations, and potential lateral movement within the network. Given the nature of monitoring and observability platforms, this vulnerability could lead to a compromise of the entire monitored infrastructure. While the number of victims is unknown, all OneUptime instances running versions prior to 10.0.35 are susceptible.

Recommendation

• Upgrade OneUptime to version 10.0.35 or later to patch CVE-2026-33396.
• Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts targeting CVE-2026-33396.
• Review and harden the Synthetic Monitor input validation and sanitization processes within OneUptime.
• Implement strict network segmentation to limit the potential impact of a compromised Probe container/host.