OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in `NetworkPathMonitor.performTraceroute()` allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into a monitor's destination field. Version 10.0.7 fixes the vulnerability.

Affected: npm: @oneuptime/common

## Summary

An OS command injection vulnerability in `NetworkPathMonitor.performTraceroute()` allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into a monitor's destination field.

## Details

The vulnerability exists in [`Probe/Utils/Monitors/MonitorTypes/NetworkPathMonitor.ts`](Probe/Utils/Monitors/MonitorTypes/NetworkPathMonitor.ts), lines 149–191.

The `performTraceroute()` method constructs a shell command by directly interpolating the user-controlled `destination` parameter into a string template, then executes it via `child_process.exec()` (wrapped through `promisify`):

```typescript // Line 13 — exec imported from child_process import { exec } from "child_process";

// Line 15-17 — promisified into execAsync const execAsync = promisify(exec);

// Lines 149-191 — destination is never sanitized private static async performTraceroute( destination: string, // ← attacker-controlled maxHops: number, timeout: number, ): Promise<TraceRoute> { // ... let command: string; if (isWindows) { command = `tracert -h ${maxHops} -w ${...} ${destination}`; } else if (isMac) { command = `traceroute -m ${maxHops} -w 3 ${destination}`; } else { command = `traceroute -m ${maxHops} -w 3 ${destination}`; }

const tracePromise = execAsync(command); // ← shell execution ```

The `destination` value originates from the public `trace()` metho…