CVE-2026-8795: Code Injection
A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostname field in clientinfo.json inside a collection ZIP is inserted into a YAML template via Go's text/template without escaping. An attacker providing a crafted collection ZIP can leverage literal double quotes and newlines in the hostname to break out of the YAML quoted string and inject a new mount remapping entry. When an analyst applies the generated remapping file with --remap, arbitrary VQL executes on their machine with NullACLManager (all permissions granted, unsandboxed).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rapid7 Velociraptorto a version that resolves this vulnerability.Fixed in 0.76.6 - Operational
Avoid applying generated remapping files with the --remap option from untrusted/crafted collection ZIPs; if you have already applied one, review and remediate any potential impact from arbitrary VQL execution on the analyst machine.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8795?
The severity of CVE-2026-8795 is high, with a score of 7.8.
How do I fix CVE-2026-8795?
To fix CVE-2026-8795, upgrade Rapid7 Velociraptor to version 0.76.6 or later.
What type of vulnerability is CVE-2026-8795?
CVE-2026-8795 is classified as a Code Injection vulnerability.
What components are affected by CVE-2026-8795?
CVE-2026-8795 affects the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor.
What can an attacker achieve with CVE-2026-8795?
An attacker can exploit CVE-2026-8795 to execute arbitrary code due to an unescaped YAML injection.