The vulnerability is an OS command injection flaw in alseambusher/crontab‑ui (up to version 0.4.2). Unauthenticated attackers can insert arbitrary cron job entries by sending a crafted GET request to /crontab with URL‑encoded newline characters in the env_vars parameter. The application concatenates the supplied value directly into the crontab file without input sanitization, causing the commands to be executed with the privileges of the crontab‑ui service. The result is remote code execution, as the injected cron jobs run under the application's user account.

The vulnerability affects all deployments of alseambusher/crontab‑ui prior to and including version 0.4.2. No additional vendor or product versions are listed in the advisory, so any instance of the affected application that has not migrated to a later release is susceptible.

With a CVSS score of 9.8, the flaw is considered critical. The EPSS score of 1% indicates a very low but nonzero likelihood of exploitation, yet the lack of authentication combined with the ability to inject arbitrary cron jobs makes the vulnerability potentially exploitable in environments where the service is exposed to untrusted networks. The vulnerability is not listed in CISA’s KEV catalog, but its nature warrants immediate attention. An attacker can trigger the exploit by sending a simple HTTP GET request, demonstrating a straightforward network‑based attack vector that does not require authentication.