Template injection in cron-utils
Impact
A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected.
Patches
The issue was patched and a new version released. Please upgrade to version 9.1.3.
Workarounds
There are no known workarounds up to this moment.
References
A description of the issue is provided in issue 461
For more information
If you have any questions or comments about this advisory:
- Open an issue in cron-utils Github repository
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | com.cronutils:cron-utils | < 9.1.3 | 9.1.3 |
References
- https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-pfj3-56hm-jwq5
- https://nvd.nist.gov/vuln/detail/CVE-2020-26238
- https://github.com/jmrozanec/cron-utils/issues/461
- https://github.com/jmrozanec/cron-utils/commit/4cf373f7352f5d95f0bf6512af8af326b31c835e
- https://lists.apache.org/thread.html/r390bb7630b7ea8f02bf7adbbe69c0ae8b562c527d663c543d965f959@%3Cgitbox.hive.apache.org%3E
- https://lists.apache.org/thread.html/r432a69a1a85cbcb1f1bad2aa0fbfce0367bf894bf917f6ed7118e7f0@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r50e1b5544c37e408ed7e9a958b28237b1cb9660ba2b3dba46f343e23@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r5f601d15292e3302ad0ae0e89527029546945b1cd5837af7e838d354@%3Cdev.hive.apache.org%3E
- https://lists.apache.org/thread.html/r71083c759dc627f198571b3d48b6745fe798b1d53c34f7ef8de9e7dd@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r737406bc17d49ffe8fe6a8828d390ee0a02e45e5a5b4f931180b9a93@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r855aead591697dc2e85faf66c99036e49f492431940b78d4e6d895b5@%3Cgitbox.hive.apache.org%3E
- https://lists.apache.org/thread.html/r96937fc9c82f3201b59311c067e97bce71123944f93102169a95bf5c@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r9ae9a9fb1c8e2bf95c676e7e4cd06aa04f0a3a8a9ec1a6b787afb00f@%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/ra9e81244d323898dde3c979dd7df6996e4037d14a01b6629ea443548@%3Cissues.hive.apache.org%3E
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N- Weakness (CWE)
CWE-74- Platform
- Java / Kotlin (Maven)
- Package
com.cronutils:cron-utils- Disclosed
- 24.11.2020
- Updated
- 11.10.2026 12:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-pfj3-56hm-jwq5 - CC BY 4.0
Vulnerability history: com.cronutils:cron-utils
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 11.2020 11.2021
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
Disclosures per year
- 2020: 1
- 2021: 1
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Template injection in cron-utils this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.