The issue is related to the incorrect management of code generation in the Metabase platform, which could allow remote code execution on the server. The core problem is that the embedded in-memory database H2 exposes ways for a connection string to include code that is then executed by the process running the embedded database. This means a user-supplied string can be used to inject executable code. The validation API, which can be called without validation, is the primary vector used for exploitation. Approximately 58,710 results are potentially affected.