Threats affecting pkg:github/alseambusher/crontab-ui

An OS command injection vulnerability exists in alseambusher/crontab-ui through version 0.4.2. This flaw allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to the /crontab endpoint with URL-encoded newlines in the env_vars parameter. The vulnerability has a critical severity with a CVSS score of 9.8.

CVE-2026-72589 is a critical OS command injection vulnerability in alseambusher's crontab-ui versions prior to 0.4.3. It allows unauthenticated remote attackers to execute arbitrary system commands by importing a crafted crontab database file via the POST /import endpoint, which accepts arbitrary .db files without validation and overwrites the application database.