Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2023-36821: Uptime Kuma allows attackers to run code via fake plugin
CVE-2023-36821 · published 3 years ago
Summary
If someone can log into your Uptime Kuma system, they could add a malicious plug‑in that runs any command on the server. The software failed to check that the plug‑in came from the official list, so a crafted plug‑in can execute code remotely. Update to version 1.22.1 or later to stop this behavior and restrict plug‑in installation to trusted sources.
What to do
- Update louislam uptime-kuma to version 1.22.1.
- Update uptime-kuma_project uptime-kuma to version 1.22.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | louislam | uptime-kuma |
<= 1.22.0 Fix: upgrade to 1.22.1
|
| – | uptime-kuma_project | uptime-kuma |
< 1.22.1 cpe:2.3:a:uptime-kuma_project:uptime-kuma:*:*:*:*:*:*:*:* |
Original advisory text
Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation
Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. After downloading a plugin, it's installed by calling `npm install` in the installation directory of the plugin. Because the plugin is not validated against the official list of plugins or installed with `npm install --ignore-scripts`, a maliciously crafted plugin taking advantage of npm scripts can gain remote code execution. Version 1.22.1 contains a patch for this issue.
References
- https://github.com/louislam/uptime-kuma/commit/a0736e04b2838aae198c2110db244eab6...
- https://github.com/advisories/GHSA-7grx-f945-mj96
- https://github.com/louislam/uptime-kuma/blob/8c60e902e1c76ecbbd1b0423b07ce615341... URL
- https://github.com/louislam/uptime-kuma/releases/tag/1.22.1 URL
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-7grx-f945-mj96 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-36821 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36821... Vendor Advisory
- https://github.com/louislam/uptime-kuma/pull/3346 Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-20Improper Input Validation
Timeline
Published5 Jul 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta