CVE-2026-73992: CWE-94 Improper Control of Generation of Code ('Code Injection') in Jonathan Daggerhart Query Wrangler

This vulnerability, identified as CVE-2026-73992, is a code injection flaw (CWE-94) in Query Wrangler versions <= 1.5.57. It enables remote code execution by improper control over code generation. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges but no user interaction, with scope changed and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is available to confirm remediation status.

Successful exploitation of this vulnerability allows an attacker with limited privileges to execute arbitrary code remotely on the affected system. This can lead to full compromise of the system, including unauthorized data access, modification, and potential denial of service. The critical CVSS score reflects the severe impact on system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected software and monitor for suspicious activity related to Query Wrangler. Avoid exposing the vulnerable service to untrusted networks.