CVE-2026-72590: alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alseambusher/crontab-uito a version that resolves this vulnerability.Fixed in 0.4.2 - Configuration
Modify the /crontab handler so that the env_vars parameter is validated and sanitized to remove/deny newline characters (e.g., reject %0A/%0D) before appending to the crontab file; this prevents cron job injection via env_vars.
alseambusher/crontab-ui env_vars newline handling = Strip or reject URL-encoded newline characters before writing to crontab (do not append ${envVars} as-is) - Compensating control
Restrict access to /crontab so only authenticated/authorized users can reach the handler (mitigate the unauthenticated ability to inject cron entries).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72590?
CVE-2026-72590 has a critical severity score of 9.8.
How do I fix CVE-2026-72590?
To fix CVE-2026-72590, upgrade to a patched version of alseambusher/crontab-ui beyond 0.4.2 that addresses this vulnerability.
What is the impact of CVE-2026-72590?
CVE-2026-72590 allows unauthenticated remote attackers to perform remote code execution through command injection.
Which software is affected by CVE-2026-72590?
CVE-2026-72590 affects versions of alseambusher/crontab-ui up to and including 0.4.2.
What type of vulnerability is CVE-2026-72590 classified as?
CVE-2026-72590 is classified as an OS command injection vulnerability.