Rapid7 · Velociraptor · CVE-2026-8795
**Name of the Vulnerable Software and Affected Versions**
Rapid7 Velociraptor versions prior to 0.76.6
**Description**
A YAML injection issue exists in the Windows.Collectors.Remapping artifact. The `hostname` field within the `client info.json` file of a collection ZIP is inserted into a YAML template using Go's text/template without proper escaping. An attacker can use literal double quotes and newlines in the `hostname` variable to break the YAML quoted string and inject a new mount remapping entry. If an analyst applies the resulting remapping file using the `--remap` flag, arbitrary VQL (Velociraptor Query Language) executes on the machine with NullACLManager, granting all permissions and bypassing the sandbox.
**Recommendations**
Update to version 0.76.6 or later.