This vulnerability in crontab-ui (alseambusher) versions up to 0.4.2 allows unauthenticated remote attackers to perform OS command injection by injecting arbitrary cron job entries. The attack vector is a crafted GET request to the /crontab endpoint with URL-encoded newline characters in the env_vars parameter. The application appends this parameter directly to the crontab file string as '${envVars}\n' without neutralizing CRLF sequences, enabling insertion of malicious cron expressions that execute arbitrary commands.

Successful exploitation can lead to full system compromise with high confidentiality, integrity, and availability impact, as arbitrary commands can be executed with the privileges of the crontab-ui process. This can result in unauthorized system control, data theft, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the crontab-ui service to trusted users only and consider disabling or limiting the /crontab endpoint to prevent exploitation.