EUVD-2026-55216
GHSA-25qx-69jj-jfcj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Default deployments expose /crontab without auth (PR:N) over the network with a simple single request (AC:L); newline-injected cron jobs run arbitrary commands, giving full C:H/I:H/A:H on the same system (S:U).
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
3DescriptionCVE.org
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter. The handler appends the env_vars value directly to the crontab file string as '${envVars}\n' without stripping newline characters, enabling an attacker to insert arbitrary cron expressions that execute attacker-controlled commands.
AnalysisAI
Cron/OS command injection in alseambusher's crontab-ui (through 0.4.2) lets a remote attacker who can reach the web interface inject arbitrary cron entries via a crafted GET request to /crontab, where the env_vars parameter is written into the crontab file without stripping newlines. Because scheduled cron jobs execute shell commands, successful injection yields arbitrary command execution as the account running the cron daemon/crontab-ui service. CVSS is rated 9.8 (network, low complexity, no privileges per the supplied vector); no public exploit and no CISA KEV entry are indicated at time of analysis, though the technique is simple to reproduce.
Technical ContextAI
crontab-ui is a self-hosted Node.js/Express web application (distributed via npm and Docker) that provides a browser UI for creating, editing, and managing Unix cron jobs, persisting them and syncing to the system crontab. The flaw is CWE-93 (Improper Neutralization of CRLF Sequences / CRLF injection): the /crontab handler in app.js concatenates the user-supplied env_vars value into the crontab file string as '${envVars}\n' without filtering embedded newline (\n / URL-encoded %0A) characters. Since the crontab file format is newline-delimited, an injected newline lets the attacker terminate the intended env-var line and append a fully-formed cron expression of their choosing, which the cron scheduler then runs as a normal command. The single affected package is identified by CPE cpe:2.3:a:alseambusher:crontab-ui:*.
RemediationAI
No vendor-released patch version was identified in the provided data (references point only to the project repository and app.js, not to a tagged fixed release), so patch status is: no vendor-released patch identified at time of analysis - monitor https://github.com/alseambusher/crontab-ui for a fixed release above 0.4.2 and upgrade as soon as one is published. Until then, apply compensating controls: enable crontab-ui's HTTP Basic authentication (set BASIC_AUTH_USER/BASIC_AUTH_PWD) so the /crontab endpoint is not anonymously reachable; bind the service to localhost or place it behind an authenticated reverse proxy/VPN and firewall off direct external access to its port (default 8000), accepting that this removes convenient remote access; and where a proxy is in front, block or reject requests to /crontab containing URL-encoded newline sequences (%0A, %0D) in the env_vars parameter as an input-filtering stopgap, noting this is fragile against alternate encodings. Run the service as a low-privilege, non-root user to limit the impact of any successful injection.
More in Crontab Ui
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today