PT-2026-47541 · Rapid7 · Velociraptor

Artificial Intelligence · Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-8795

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostname field in client info.json inside a collection ZIP is inserted into a YAML template via Go's text/template without escaping. An attacker providing a crafted collection ZIP can leverage literal double quotes and newlines in the hostname to break out of the YAML quoted string and inject a new mount remapping entry. When an analyst applies the generated remapping file with --remap, arbitrary VQL executes on their machine with NullACLManager (all permissions granted, unsandboxed).

Fix

Special Elements Injection

Improper Encoding or Escaping of Output

Code Injection

Weakness Enumeration

CWE-74

CWE-116

CWE-94

Related Identifiers

CVE-2026-8795

Affected Products

Velociraptor

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-8795 · Security Note
• https://docs.velociraptor.app/announcements/advisories/cve-2026-8795 · Vendor Advisory