Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation

Summary Installation of a maliciously crafted plugin allows for remote code execution by an authenticated attacker. Details Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding AP...

Malicious code in node-common-npm-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02090694bde3634ac057c9ea4e4f37e4f65c597af5c1490bbe56a25e7acb8031 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8537 Malicious code in node-common-npm-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02090694bde3634ac057c9ea4e4f37e4f65c597af5c1490bbe56a25e7acb8031 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Remote code execution

Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is...