CVE-2026-8795: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-8795 is a YAML injection vulnerability in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The flaw arises because the hostname field from client_info.json inside a collection ZIP is inserted into a YAML template using Go's text/template package without proper escaping, allowing an attacker to inject arbitrary VQL code. It was published on June 9, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Velociraptor Advisory).

The root cause is improper neutralization of special elements in output used by a downstream component (CWE-74), compounded by improper control of code generation (CWE-94) and improper encoding or escaping of output (CWE-116). Specifically, Go's text/template is used to render a YAML remapping file, and the hostname value from client_info.json is interpolated directly into a YAML quoted string without escaping literal double quotes or newlines. An attacker crafts a collection ZIP with a malicious hostname containing " and newline characters to break out of the YAML string context and inject a new mount remapping entry containing arbitrary VQL. When an analyst processes this ZIP and applies the generated remapping file using the --remap flag, the injected VQL executes under NullACLManager, which grants all permissions with no sandboxing (GitHub Advisory, Velociraptor Advisory).

Successful exploitation results in arbitrary VQL code execution on the analyst's machine with full, unsandboxed permissions via NullACLManager. This grants the attacker complete confidentiality, integrity, and availability impact — including the ability to read sensitive forensic data, modify files, execute system commands, and potentially pivot to other systems accessible from the analyst's workstation. Because Velociraptor analysts typically operate with elevated access to endpoint telemetry and investigation infrastructure, compromise of their machine poses significant risk to the broader incident response environment (GitHub Advisory, Velociraptor Advisory).

1. Craft a malicious collection ZIP: Create or modify a collection ZIP file so that the hostname field in client_info.json contains embedded double quotes and newline characters (e.g., legitimate-host"\n - type: EVIL\n vql: SELECT execve(argv=['cmd','/c','calc.exe']) FROM scope()\n - type: DUMMY\n hostname: ").
2. Deliver the ZIP to the analyst: Provide the crafted ZIP to a Velociraptor analyst through any available channel — email, shared storage, a compromised endpoint upload, or a simulated collection result.
3. Trigger remapping file generation: The analyst opens the collection ZIP using the Windows.Collectors.Remapping artifact, which reads client_info.json and renders the hostname into a YAML remapping template without escaping.
4. Inject YAML structure: The embedded quotes and newlines break out of the YAML quoted string, inserting a new mount remapping entry containing the attacker's VQL payload into the generated remapping file.
5. Achieve code execution: When the analyst applies the generated remapping file with velociraptor --remap <file>, the injected VQL executes on the analyst's machine under NullACLManager with all permissions granted and no sandboxing, enabling arbitrary command execution, data exfiltration, or further lateral movement (GitHub Advisory, Velociraptor Advisory).

• File System: Unexpected or externally-sourced collection ZIP files containing a client_info.json with a hostname field that includes literal double quotes (") or newline characters (\n); generated YAML remapping files with anomalous or unexpected vql: entries or extra mount remapping blocks.
• Process: Unusual child processes spawned by the Velociraptor binary after --remap execution (e.g., cmd.exe, powershell.exe, bash, curl, wget); unexpected network connections originating from the Velociraptor process.
• Logs: Velociraptor execution logs showing --remap invocations with externally-provided remapping files; VQL execution logs referencing unexpected artifacts or execve/shell-related VQL functions.
• Network: Outbound connections from the analyst's workstation to unknown external IPs or domains shortly after processing a collection ZIP with --remap.

Rapid7 has released Velociraptor version 0.76.6, which addresses this vulnerability by properly escaping the hostname field before inserting it into the YAML template (Velociraptor Advisory). Organizations should upgrade to version 0.76.6 or later as the primary remediation. Until patching is complete, analysts should avoid applying remapping files generated from collection ZIPs received from untrusted or unverified sources, and should manually inspect client_info.json hostname fields for embedded special characters before processing with --remap.

The vulnerability received brief attention on social media, with posts noted on Mastodon (@thehackerwire and @hugovalters) and Bluesky shortly after disclosure. Coverage was primarily limited to automated vulnerability tracking feeds and aggregators. No significant vendor statements beyond the official Rapid7/Velociraptor advisory, and no notable independent researcher commentary has been identified.