{"record":{"id":"c817d48b4834494a","repo":"louislam/uptime-kuma","slug":"this-chromium-executable-path-is-not-allowed-by-de","errorCode":null,"errorMessage":"This Chromium executable path is not allowed by default. If you are sure this is safe, please add an environment variable UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1 to allow it.","messagePattern":"This Chromium executable path is not allowed by default\\. If you are sure this is safe, please add an environment variable UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1 to allow it\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/monitor-types/real-browser-monitor-type.js","lineNumber":129,"sourceCode":" * @returns {Promise<string>} Executable path\n */\nasync function prepareChromeExecutable(executablePath) {\n    // Special code for using the playwright_chromium\n    if (typeof executablePath === \"string\" && executablePath.toLocaleLowerCase() === \"#playwright_chromium\") {\n        // Set to undefined = use playwright_chromium\n        executablePath = undefined;\n    } else if (!executablePath) {\n        if (process.env.UPTIME_KUMA_IS_CONTAINER) {\n            executablePath = \"/usr/bin/chromium\";\n            await installChromiumViaApt(executablePath);\n        } else {\n            executablePath = await findChrome(allowedList);\n        }\n    } else {\n        // User specified a path\n        // Check if the executablePath is in the list of allowed\n        if (!(await isAllowedChromeExecutable(executablePath))) {\n            throw new Error(\n                \"This Chromium executable path is not allowed by default. If you are sure this is safe, please add an environment variable UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1 to allow it.\"\n            );\n        }\n    }\n    return executablePath;\n}\n\n/**\n * Installs Chromium and required font packages via APT if the Chromium executable\n * is not already available.\n * @async\n * @param {string} executablePath - Path to the Chromium executable used to check\n * whether Chromium is available and to query its version after installation.\n * @returns {Promise<void>} Resolves when Chromium is successfully installed or\n * when no installation is required.\n * @throws {Error} If the APT installation fails or exits with an unexpected\n * exit code.\n */","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/louislam/uptime-kuma/blob/6b5ea0155793e666666745fb8d6fef1e829543a2/server/monitor-types/real-browser-monitor-type.js#L111-L147","documentation":"When a user supplies an explicit Chromium executable path, the monitor validates it against an allow-list (isAllowedChromeExecutable) unless the escape-hatch env var UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1 is set. A path not on the list is rejected to prevent arbitrary executable execution from user input. This throw is the security gate at real-browser-monitor-type.js:129.","triggerScenarios":"monitor (or settings) specifies executablePath pointing somewhere outside the allowed list (e.g. /opt/custom/chrome, a Snap path, a different distro's binary) and UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC is unset.","commonSituations":"Custom Chromium install location, Snap/Flatpak Chromium paths, container with a non-standard binary path, or a user pasting a path they trust but the allow-list does not include.","solutions":["Leave executablePath empty and let the monitor auto-detect an allowed Chromium.","Install Chromium to a standard path that the allow-list recognises.","If you trust the path and accept the risk, set UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1 in the environment.","Update the allow-list configuration if your deployment defines one."],"exampleFix":"# before\n# user sets executablePath=/opt/custom/chrome with env unset\n# after (option A - safe)\n# clear executablePath and install chromium to a standard path\n# after (option B - explicit override, understand the risk)\nexport UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1","handlingStrategy":"validation","validationCode":"const { isAllowedChromeExecutable } = require('...real-browser-monitor-type');\nasync function validateChromePath(path) {\n  if (!path) return; // auto-detect\n  if (process.env.UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC === '1') return;\n  if (!(await isAllowedChromeExecutable(path))) {\n    throw new Error('Chrome path not on allow-list; set UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1 if trusted');\n  }\n}","typeGuard":"function isAllowListEscapeSet() { return process.env.UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC === '1'; }","tryCatchPattern":"try {\n  await prepareChromeExecutable(path);\n} catch (e) {\n  if (/not allowed by default/.test(e.message)) {\n    // either clear path, install to standard location, or set the env var deliberately\n  }\n  throw e;\n}","preventionTips":["Prefer auto-detection (leave path empty) in trusted environments.","Document the allow-list and the escape-hatch env var for operators.","Treat setting UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1 as a security-relevant change to review."],"tags":["chromium","security","config","env"],"backgroundTag":null,"analyzedSha":"6b5ea0155793e666666745fb8d6fef1e829543a2","analyzedAt":"2026-08-12T23:42:12.959Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}