CVE-2026-72590

Name of the Vulnerable Software and Affected Versions alseambusher/crontab-ui versions prior to 0.4.3

Description An OS command injection flaw allows an unauthenticated remote attacker to inject arbitrary cron job entries. This occurs when a crafted GET request is sent to the '/crontab' endpoint with URL-encoded newlines in the env vars parameter. The handler appends the env vars value directly to the crontab file string as '${envVars} ' without stripping newline characters, which enables the insertion of arbitrary cron expressions that execute attacker-controlled commands.

Recommendations Update alseambusher/crontab-ui to version 0.4.3 or later. Avoid using the env vars parameter in the '/crontab' endpoint until the software is updated.