This vulnerability (CWE-93) in crontab-ui versions through 0.4.2 involves improper neutralization of CRLF sequences, enabling an unauthenticated attacker to perform OS command injection. By exploiting the env_vars parameter in a GET request to /crontab, the attacker can inject arbitrary cron jobs, potentially leading to full system compromise. The CVSS 3.1 score is 9.8, reflecting high impact on confidentiality, integrity, and availability without requiring privileges or user interaction.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on the affected system by injecting cron jobs, which can lead to full system compromise including data theft, service disruption, or further network penetration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /crontab endpoint and monitor for suspicious requests containing URL-encoded newline characters in the env_vars parameter.