louislam/uptime-kuma · error · Error

This Chromium executable path is not allowed by default. If

Error message

This Chromium executable path is not allowed by default. If you are sure this is safe, please add an environment variable UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1 to allow it.

What it means

When a user supplies an explicit Chromium executable path, the monitor validates it against an allow-list (isAllowedChromeExecutable) unless the escape-hatch env var UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1 is set. A path not on the list is rejected to prevent arbitrary executable execution from user input. This throw is the security gate at real-browser-monitor-type.js:129.

Source

Thrown at server/monitor-types/real-browser-monitor-type.js:129

 * @returns {Promise<string>} Executable path
 */
async function prepareChromeExecutable(executablePath) {
    // Special code for using the playwright_chromium
    if (typeof executablePath === "string" && executablePath.toLocaleLowerCase() === "#playwright_chromium") {
        // Set to undefined = use playwright_chromium
        executablePath = undefined;
    } else if (!executablePath) {
        if (process.env.UPTIME_KUMA_IS_CONTAINER) {
            executablePath = "/usr/bin/chromium";
            await installChromiumViaApt(executablePath);
        } else {
            executablePath = await findChrome(allowedList);
        }
    } else {
        // User specified a path
        // Check if the executablePath is in the list of allowed
        if (!(await isAllowedChromeExecutable(executablePath))) {
            throw new Error(
                "This Chromium executable path is not allowed by default. If you are sure this is safe, please add an environment variable UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1 to allow it."
            );
        }
    }
    return executablePath;
}

/**
 * Installs Chromium and required font packages via APT if the Chromium executable
 * is not already available.
 * @async
 * @param {string} executablePath - Path to the Chromium executable used to check
 * whether Chromium is available and to query its version after installation.
 * @returns {Promise<void>} Resolves when Chromium is successfully installed or
 * when no installation is required.
 * @throws {Error} If the APT installation fails or exits with an unexpected
 * exit code.
 */

View on GitHub (pinned to 6b5ea01557)

Solutions

1. Leave executablePath empty and let the monitor auto-detect an allowed Chromium.
2. Install Chromium to a standard path that the allow-list recognises.
3. If you trust the path and accept the risk, set UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1 in the environment.
4. Update the allow-list configuration if your deployment defines one.

Example fix

# before
# user sets executablePath=/opt/custom/chrome with env unset
# after (option A - safe)
# clear executablePath and install chromium to a standard path
# after (option B - explicit override, understand the risk)
export UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1

const { isAllowedChromeExecutable } = require('...real-browser-monitor-type');
async function validateChromePath(path) {
  if (!path) return; // auto-detect
  if (process.env.UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC === '1') return;
  if (!(await isAllowedChromeExecutable(path))) {
    throw new Error('Chrome path not on allow-list; set UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC=1 if trusted');
  }
}

function isAllowListEscapeSet() { return process.env.UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC === '1'; }

try {
  await prepareChromeExecutable(path);
} catch (e) {
  if (/not allowed by default/.test(e.message)) {
    // either clear path, install to standard location, or set the env var deliberately
  }
  throw e;
}

When it happens

Trigger: monitor (or settings) specifies executablePath pointing somewhere outside the allowed list (e.g. /opt/custom/chrome, a Snap path, a different distro's binary) and UPTIME_KUMA_ALLOW_ALL_CHROME_EXEC is unset.

Common situations: Custom Chromium install location, Snap/Flatpak Chromium paths, container with a non-standard binary path, or a user pasting a path they trust but the allow-list does not include.

Related errors

• Chromium not found, please specify Chromium executable path
• Invalid url protocol, only http and https are allowed.
• Invalid db-config.json, type must be a string
• Unknown Database type: ${dbConfig.type}
• Failed to load docker host config

AI-assisted analysis of louislam/uptime-kuma@6b5ea01557 (2026-08-12). Data as JSON: /api/errors/c817d48b4834494a. Report an issue: GitHub.