This vulnerability (CVE-2026-90817) in REDCap allows unauthenticated remote code execution due to improper control of code generation (CWE-94) in the survey passthrough routing and Data Import processing logic. Exploitation requires knowledge of a valid public survey hash, enabling an attacker to manipulate HTTP requests to access unintended controller routes and supply crafted parameters during import handling. This can lead to arbitrary code execution on the server. The vulnerability affects REDCap version 13.3.0 and higher. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation allows an unauthenticated attacker to remotely execute arbitrary code on the REDCap server, potentially leading to full system compromise. The attacker must know a valid public survey hash to exploit the flaw. The impact includes complete confidentiality, integrity, and availability loss on the affected system.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to public survey hashes and monitor for suspicious activity related to survey passthrough routing and data import processing.