@oneuptime/common@9.4.2

@oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c

Affected versions of this package are vulnerable to SQL Injection due to user-supplied parameters in the aggregation API endpoint. An attacker can access and modify sensitive database information, execute arbitrary SQL commands, and potentially achieve remote code execution by injecting crafted input into the aggregationType, aggregateColumnName, or aggregationTimestampColumnName fields.

Upgrade @oneuptime/common to version 10.0.23 or higher.

@oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the MarkdownViewer process when rendering Mermaid diagrams with securityLevel set to "loose" and injecting SVG output via innerHTML. An attacker can execute arbitrary JavaScript in the context of the application by submitting specially crafted Mermaid diagram payloads to any markdown-rendered field, such as incident notes, status page announcements, or monitor descriptions.

Upgrade @oneuptime/common to version 10.0.23 or higher.

@oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the LogAggregationService. An attacker can gain unauthorized access to user accounts by extracting password reset tokens from application logs and using them to reset passwords.

Upgrade @oneuptime/common to version 10.0.24 or higher.

@oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c

Affected versions of this package are vulnerable to Missing Authorization via the GitHub API endpoints. An attacker can overwrite another project's GitHub App installation binding, enumerate repositories, and create records in arbitrary projects by supplying crafted state and installation_id parameters without proper authorization checks.

Upgrade @oneuptime/common to version 10.0.19 or higher.

@oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the UserCall, UserEmail, UserSMS and UserWhatsApp endpoints. An attacker can trigger repeated verification code resends to arbitrary users by providing the itemId of any UserWhatsApp record within the same project, potentially leading to spam, denial of service against victims' phone numbers, or facilitating social engineering attacks.

Upgrade @oneuptime/common to version 10.0.21 or higher.

@oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c

Affected versions of this package are vulnerable to Missing Authorization in the handling of the is-multi-tenant-query header, which is trusted from client input. An attacker can gain unauthorized access to other tenants' data, read sensitive user credential fields, and take over accounts by sending crafted requests that bypass internal permission checks.

Upgrade @oneuptime/common to version 10.0.21 or higher.

@oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c

Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via exposed Playwright browser objects. An attacker can execute arbitrary commands on the host system by leveraging exposed methods such as browser.browserType().launch() with attacker-controlled options.

Note: This is considered a separate issue from the previously published SNYK-JS-ONEUPTIMECOMMON-15440733 since the underlying issue is the exposure of a dangerous host capability object to untrusted code, not prototype-chain access to process.

Upgrade @oneuptime/common to version 10.0.21 or higher.

@oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c

Affected versions of this package are vulnerable to Arbitrary Code Injection via the vm.runInContext function. An attacker can execute arbitrary system commands and exfiltrate sensitive environment variables by submitting crafted JavaScript payloads through the Synthetic Monitor feature.

Note: In the context of oneuptime, the code is executed on the oneuptime-probe container, which holds database/cluster credentials in its environment variables. This directly leads to a complete compromise of the cluster.

Upgrade @oneuptime/common to version 10.0.18 or higher.

@oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c

Affected versions of this package are vulnerable to Replay Attack in the 2FA WebAuthn authentication due to the the challenge not being stored on the server side. An attacker can gain unauthorized access to user accounts by replaying a previously captured valid authentication assertion, provided they have also obtained the user's password.

Upgrade @oneuptime/common to version 10.0.15 or higher.