osqueryi can be used to run arbitrary queries, and I suppose anyone who gets a hold of the server-side ability to run ad-hoc queries can push arbitrary queries. I haven't read the vuln details, so I might be missing something.