CVE-2021-41269

cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known.

• CWE-94

• https://github.com/jmrozanec/cron-utils/commit/cfd2880f80e62ea74b92fa83474c2aabdb9899daPatch, Third Party Advisory
• https://github.com/jmrozanec/cron-utils/commit/d6707503ec2f20947f79e38f861dba93b39df9daPatch, Third Party Advisory
• https://github.com/jmrozanec/cron-utils/issues/461Exploit, Issue Tracking, Third Party Advisory
• https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-p9m8-27x8-rg87Third Party Advisory
• https://github.com/jmrozanec/cron-utils/commit/cfd2880f80e62ea74b92fa83474c2aabdb9899daPatch, Third Party Advisory
• https://github.com/jmrozanec/cron-utils/commit/d6707503ec2f20947f79e38f861dba93b39df9daPatch, Third Party Advisory
• https://github.com/jmrozanec/cron-utils/issues/461Exploit, Issue Tracking, Third Party Advisory
• https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-p9m8-27x8-rg87Third Party Advisory

Published

Nov 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41263rails_multisite provides multi-db support for Rails applicat…8.8
• CVE-2021-41264OpenZeppelin Contracts is a library for smart contract devel…9.8
• CVE-2021-41265Flask-AppBuilder is a development framework built on top of …8.8
• CVE-2021-41266Minio console is a graphical user interface for the for MinI…9.8
• CVE-2021-41267Symfony/Http-Kernel is the HTTP kernel component for Symfony…6.5
• CVE-2021-41268Symfony/SecurityBundle is the security system for Symfony, a…8.8
• CVE-2021-4127An out of date graphics library (Angle) likely contained vul…9.8
• CVE-2021-41270Symfony/Serializer handles serializing and deserializing dat…6.5
• CVE-2021-41271Discourse is a platform for community discussion. In affecte…5.3
• CVE-2021-41272Besu is an Ethereum client written in Java. Starting in vers…7.5
• CVE-2021-41273Pterodactyl is an open-source game server management panel b…4.3
• CVE-2021-41274solidus_auth_devise provides authentication services for the…8.8