CVE-2020-26238

Name of the Vulnerable Software and Affected Versions cron-utils versions prior to 9.1.3

Description A template injection vulnerability is present in cron-utils, enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This issue affects only projects using the @Cron annotation to validate untrusted Cron expressions.

Recommendations For versions prior to 9.1.3, upgrade to version 9.1.3 to resolve the issue. As a temporary workaround, consider avoiding the use of the @Cron annotation to validate untrusted Cron expressions until the patch is applied.