Ghoststar

**Name of the Vulnerable Software and Affected Versions** jiacrontab version 1.4.5 **Description** The issue allows remote attackers to execute arbitrary commands. This can be achieved via the crontab/task/edit API endpoint, specifically by manipulating the `command` and `args` parameters in the POST data. For example, setting `command=cat` and `args=/etc/passwd` can lead to the execution of unwanted commands. **Recommendations** For jiacrontab version 1.4.5, as a temporary workaround, consider restricting access to the crontab/task/edit API endpoint until a patch is available. Avoid using the `command` and `args` parameters in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.