https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 14:18:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-196446 EUVD-2026-196446 https://cve.radiocsirt.org/vuln/euvd-2026-196446 https://cve.radiocsirt.org/vuln/fkie_cve-2023-36821 <p>Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. After downloading a plugin, it&#39;s installed by calling `npm install` in the installation directory of the plugin. Because the plugin is not validated against the official list of plugins or installed with `npm install --ignore-scripts`, a maliciously crafted plugin taking advantage of npm scripts can gain remote code execution. Version 1.22.1 contains a patch for this issue.</p> <p>Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. After downloading a plugin, it&#39;s installed by calling `npm install` in the installation directory of the plugin. Because the plugin is not validated against the official list of plugins or installed with `npm install --ignore-scripts`, a maliciously crafted plugin taking advantage of npm scripts can gain remote code execution. Version 1.22.1 contains a patch for this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-36821 https://cve.radiocsirt.org/vuln/ghsa-7grx-f945-mj96 <p><strong>Affected:</strong> npm: uptime-kuma</p> <p>### Summary Installation of a maliciously crafted plugin allows for remote code execution by an authenticated attacker.</p> <p>### Details Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. After downloading a plugin, it&#39;s installed by calling `npm install` in the installation directory of the plugin: https://github.com/louislam/uptime-kuma/blob/8c60e902e1c76ecbbd1b0423b07ce615341cb850/server/plugins-manager.js#L210-L216</p> <p>Because the plugin is not validated against the official list of plugins or installed with `npm install --ignore-scripts`, a maliciously crafted plugin taking advantage of [npm scripts](https://docs.npmjs.com/cli/v9/using-npm/scripts) can gain remote code execution.</p> <p>### PoC In the PoC below, the plugin at https://github.com/n-thumann/npm-install-script-poc will be installed. It only consists of an empty `index.js` and a `package.json` containing the script: `&#34;preinstall&#34;: &#34;echo \&#34;Malicious code could have been executed as user $(whoami)\&#34; &gt; /tmp/poc&#34;`. This will be executed when installing the plugin.</p> <p>1. Start Uptime Kuma: `docker run -d -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:1` 2. Create a user using the Uptime Kuma web interface, e.g. user `admin` with password `admin123` 3. Confirm that the PoC file to be created doesn&#39;t exist yet: ``` ➜ ~ docker exec -it…</p> <p><strong>Affected:</strong> npm: uptime-kuma</p> <p>### Summary Installation of a maliciously crafted plugin allows for remote code execution by an authenticated attacker.</p> <p>### Details Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. After downloading a plugin, it&#39;s installed by calling `npm install` in the installation directory of the plugin: https://github.com/louislam/uptime-kuma/blob/8c60e902e1c76ecbbd1b0423b07ce615341cb850/server/plugins-manager.js#L210-L216</p> <p>Because the plugin is not validated against the official list of plugins or installed with `npm install --ignore-scripts`, a maliciously crafted plugin taking advantage of [npm scripts](https://docs.npmjs.com/cli/v9/using-npm/scripts) can gain remote code execution.</p> <p>### PoC In the PoC below, the plugin at https://github.com/n-thumann/npm-install-script-poc will be installed. It only consists of an empty `index.js` and a `package.json` containing the script: `&#34;preinstall&#34;: &#34;echo \&#34;Malicious code could have been executed as user $(whoami)\&#34; &gt; /tmp/poc&#34;`. This will be executed when installing the plugin.</p> <p>1. Start Uptime Kuma: `docker run -d -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:1` 2. Create a user using the Uptime Kuma web interface, e.g. user `admin` with password `admin123` 3. Confirm that the PoC file to be created doesn&#39;t exist yet: ``` ➜ ~ docker exec -it…</p> https://cve.radiocsirt.org/vuln/ghsa-7grx-f945-mj96 https://cve.radiocsirt.org/vuln/gsd-2023-36821 gsd-2023-36821 https://cve.radiocsirt.org/vuln/gsd-2023-36821