The vulnerability occurs in the Asset Handler/Aggregate Handler of Cockpit‑HQ Cockpit and is caused by improper neutralization of special elements in data query logic. The flaw allows a malicious actor to inject crafted query content when interacting with the handler, potentially influencing data retrieval or other query logic without executing arbitrary commands. The impact is limited to confidentiality and integrity of the queried data, though broader system disruption could arise if query logic misbehaves.

Cockpit‑HQ Cockpit, versions up to 2.13.5 are affected. Any deployment that exposes the Asset Handler or Aggregate Handler functionality to external traffic is at risk.

The CVSS score of 5.3 indicates a moderate risk. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, but the public disclosure and remote nature of the attack suggest that exploitation is feasible from outside the network. An attacker can send specially crafted queries to the vulnerable endpoint, leveraging the injection to manipulate data retrieval or execution flows. Given the moderate severity and remote exploitability, immediate attention is warranted to prevent potential compromise.