Every CVE Search/ Get API key

CVE-2020-26238

Critical vulnerability found in cron-utils

7.9 HighFix available

CVE-2020-26238 is a high vulnerability (CVSS 7.9) in Cron-utils Project Cron-utils, published November 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.20%, the 90th percentile. Fixed in com.cronutils:cron-utils 9.1.3.

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

4.20%Down 18.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.9

Critical vulnerability found in cron-utils

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.

Record
CVE-2020-26238
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-74
Updated
2026-11-02
EUVDEUVD-2020-1466 7.9

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.

Record
EUVD-2020-1466
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-pfj3-56hm-jwq5 7.9

Template injection in cron-utils

Impact

A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected.

Patches

The issue was patched and a new version released. Please upgrade to version 9.1.3.

Workarounds

There are no known workarounds up to this moment.

References

A description of the issue is provided in issue 461

For more information

If you have any questions or comments about this advisory:

Record
GHSA-pfj3-56hm-jwq5
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-74
Updated
2026-11-02
NVD 7.9

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.

Record
CVE-2020-26238
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-74
Updated
2026-11-02
OSV 8.1

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.

Record
CVE-2020-26238
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-pfj3-56hm-jwq5 7.9

Template injection in cron-utils

Impact

A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected.

Patches

The issue was patched and a new version released. Please upgrade to version 9.1.3.

Workarounds

There are no known workarounds up to this moment.

References

A description of the issue is provided in issue 461

For more information

If you have any questions or comments about this advisory:

Record
GHSA-pfj3-56hm-jwq5
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-74
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
com.cronutils:cron-utils
Maven
 before 9.1.3
9.1.3
com.cronutils:cron-utils
Maven
 before 9.1.3, plus listed versions
1.0.01.1.01.1.11.1.22.0.0
Show 43 moreShow less
3.0.03.1.03.1.13.1.23.1.43.1.53.1.63.1.74.0.04.0.14.1.04.1.14.1.24.1.35.0.05.0.15.0.25.0.35.0.45.0.56.0.06.0.16.0.26.0.36.0.46.0.56.0.67.0.07.0.17.0.27.0.37.0.47.0.57.0.67.0.78.0.08.1.19.0.09.0.19.0.29.1.09.1.19.1.2
9.1.3

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open