What is the CVSS score of CVE-2026-72589?

CVE-2026-72589 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.2%.

Which versions of crontab-ui are affected by CVE-2026-72589?

crontab-ui version 0.4.2 and earlier contains a critical unauthenticated OS command injection vulnerability accessible through the /import endpoint, allowing remote attackers to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-72589?

Within 24 hours: identify all crontab-ui deployments running version 0.4.2 or earlier and immediately restrict network access to the /import endpoint using firewall rules; if version cannot be confirmed, assume all instances are vulnerable and place them behind VPN or firewall access controls restricted to administrative networks. Within 7 days: review instance logs for unauthorized POST requests to /import since deployment; audit crontab job history and configuration for suspicious modifications, unexpected hook values, or command injections that indicate prior exploitation. Within 30 days: migrate to an alternative cron management solution; if discontinuation is infeasible, implement permanent network segmentation and restrict /import endpoint access exclusively to trusted administrative hosts via firewall or network appliance.

crontab-ui CVE-2026-72589

EUVD-2026-55217 CRITICAL

OS Command Injection (CWE-78)

2026-08-10 TuranSec

GHSA-r4j6-x8h7-4f8w

Command Injection Crontab Ui

9.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network POST to /import (AV:N/AC:L/PR:N/UI:N) yields full RCE as the service account, so C:H/I:H/A:H; scope unchanged as execution stays within the host's privilege context.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 12:17 EUVD

Analysis Generated

Aug 10, 2026 - 11:25 vuln.today

CVE Published

Aug 10, 2026 - 10:41 cve.org

CRITICAL 9.8

DescriptionCVE.org

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation. The hook field value is embedded directly into a shell command by crontab.js makeCommand() without sanitization, so a malicious hook value in the imported file results in command execution on the next cron execution cycle.

AnalysisAI

OS command injection in alseambusher/crontab-ui through 0.4.2 lets a remote, unauthenticated attacker POST a crafted crontab database to the /import endpoint, which silently overwrites the application's job database; a malicious 'hook' value is then concatenated into a shell command by makeCommand() and runs on the next cron cycle. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects trivial, pre-authentication reachability with full confidentiality, integrity, and availability impact on the host. Any internet- or LAN-exposed crontab-ui instance without an external access-control layer should be treated as high priority.

Technical ContextAI

crontab-ui is a Node.js/Express web application that provides a browser front end for creating, editing, and scheduling Unix cron jobs, storing job definitions in an NeDB-style .db file. The vulnerability is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the crontab.js makeCommand() routine builds the shell string that cron will execute and interpolates the user-controllable 'hook' field directly, with no escaping or allow-listing, so shell metacharacters in that field break out of the intended command. The exposure is amplified by the POST /import handler, which accepts an arbitrary uploaded .db file and replaces the live database wholesale without authentication or content validation, giving the attacker full control over every job record including the hook field. Per the CPE cpe:2.3:a:alseambusher:crontab-ui:*, all versions up to and including 0.4.2 are in scope.

RemediationAI

No vendor-released patch identified at time of analysis, and the supplied references point only to the project repository and source file rather than a tagged fixed release, so no exact fix version can be cited. Until a patched release is confirmed, the highest-value compensating control is to remove unauthenticated network exposure of the /import endpoint: place crontab-ui behind an authenticating reverse proxy or VPN and restrict access to trusted admin networks (trade-off: adds an access-control dependency and may break existing automation that calls the UI). Specifically block or deny external POST requests to the /import path at the proxy, since import is rarely needed in normal operation (trade-off: legitimate database restores must then be performed locally). Bind the service to localhost or a management interface rather than 0.0.0.0, and run it under a low-privilege, non-root account so that a successful hook injection cannot execute as root (trade-off: cron jobs needing elevated rights must be re-architected). Monitor for unexpected changes to the crontab .db file and for new or modified hook values. Track the upstream repository (https://github.com/alseambusher/crontab-ui) for an official fix and upgrade as soon as a patched version is published.