Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2021-41269 Details

Description

cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:10 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/jmrozanec/cron-utils/commit/cfd2880f80e62ea74b92fa83474c2aabdb9899da	CVE	PatchThird Party Advisory
https://github.com/jmrozanec/cron-utils/commit/d6707503ec2f20947f79e38f861dba93b39df9da	CVE	PatchThird Party Advisory
https://github.com/jmrozanec/cron-utils/issues/461	CVE	ExploitIssue TrackingThird Party Advisory
https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-p9m8-27x8-rg87	CVE	Third Party Advisory
https://github.com/jmrozanec/cron-utils/commit/cfd2880f80e62ea74b92fa83474c2aabdb9899da	[email protected]	PatchThird Party Advisory
https://github.com/jmrozanec/cron-utils/commit/d6707503ec2f20947f79e38f861dba93b39df9da	[email protected]	PatchThird Party Advisory
https://github.com/jmrozanec/cron-utils/issues/461	[email protected]	ExploitIssue TrackingThird Party Advisory
https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-p9m8-27x8-rg87	[email protected]	Third Party Advisory

see all 8 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-94	Improper Control of Generation of Code ('Code Injection')	[email protected]

Affected Products

Product	Versions
cron-utils project cron-utils	< 9.1.6
CPE cpe:2.3:a:cron-utils_project:cron-utils:::::::: Remediation No remediation found in references.

Change History

4 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Nov 19, 2021	Initial Analysis	[email protected]