This vulnerability arises from improper neutralization of special elements in output used by a downstream component (CWE-74). Specifically, the hostname field in client_info.json is inserted into a YAML template using Go's text/template without escaping special characters such as double quotes and newlines. This allows an attacker supplying a crafted collection ZIP to inject new mount remapping entries into the YAML file. When the analyst applies the remapping file with the --remap flag, the injected VQL code executes with NullACLManager privileges, granting all permissions without sandbox restrictions. The CVSS 3.1 score is 7.8 (High), reflecting local attack vector with low complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary VQL code on the analyst's machine with full permissions and no sandboxing. This can lead to complete compromise of the analyst's environment, including unauthorized data access, modification, and disruption of service. The attack requires the analyst to apply a maliciously crafted remapping file, making user interaction necessary.

Patch status is not yet confirmed — no official fix or remediation level has been published by Rapid7 as of the provided data. Users should monitor Rapid7's advisories for updates and apply any forthcoming patches promptly. Until a fix is available, analysts should exercise caution when applying remapping files from untrusted sources and avoid using the --remap option with unverified collection ZIPs.