CVE-2021-41269

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Nov 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-41279.8An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thu CVE-2021-412706.5Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a CVE-2021-412715.3Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cac CVE-2021-412727.5Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations r CVE-2021-412734.3Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on CVE-2021-412748.8solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_CVE-2021-412758.8spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront frame CVE-2021-412767.2Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does CVE-2021-412777.5Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`CVE-2021-412785.7Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting da CVE-2021-412798.8BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privi CVE-2021-41286.5When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potent