CVE-2026-8795 Details
Description
A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostname field in client_info.json inside a collection ZIP is inserted into a YAML template via Go's text/template without escaping. An attacker providing a crafted collection ZIP can leverage literal double quotes and newlines in the hostname to break out of the YAML quoted string and inject a new mount remapping entry. When an analyst applies the generated remapping file with --remap, arbitrary VQL executes on their machine with NullACLManager (all permissions granted, unsandboxed).
A YAML injection vulnerability has been identified in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor, affecting versions prior to 0.76.6. The vulnerability arises because the hostname field in client_info.json, located within a collection ZIP, is inserted into a YAML template using Go's text/template without proper escaping. An attacker can exploit this by crafting a collection ZIP that includes literal double quotes and newlines in the hostname, breaking out of the YAML quoted string and injecting a new mount remapping entry. When the injected remapping file is applied with the --remap option, it executes arbitrary VQL on the analyst's machine with NullACLManager, granting all permissions without sandboxing.
Users can upgrade to Velociraptor version 0.76.6 or later. Alternatively, the latest Windows.Collectors.Remapping artifact can be copied from the latest release on GitHub into the Velociraptor config file.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.velociraptor.app/announcements/advisories/cve-2026-8795/ | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | New CVE Received | [email protected] |