CVE-2026-28134 is a code injection vulnerability in Crocoblock JetEngine (<= 3.7.2) caused by improper control over code generation. This flaw enables remote attackers to include and execute arbitrary code on affected systems. The vulnerability is remotely exploitable without user interaction but requires low privileges and has a high attack complexity. The CVSS 3.1 vector indicates network attack vector, high complexity, low privileges, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely, potentially leading to full system compromise, data disclosure, data modification, and service disruption. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected JetEngine installation and monitor for suspicious activity related to code injection attempts. Avoid exposing the vulnerable component to untrusted networks.