> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7... - URL: https://f4n6.co.uk/security-feed/a-yaml-injection-vulnerability-exists-in-the-windows-collectors-remapping-artifact-of-rapid7/ - Published: 2026-06-09T10:11:40.000Z - Updated: 2026-06-09T10:11:40.000Z - Author: Jeff Davies - Tags: #security-feed **Issuer:** Adverse Trace **Date issued:** 2026-06-09 **Version:** 1.0 ## 1\. Executive summary A critical YAML injection vulnerability (CVE-2026-8795) affects Rapid7 Velociraptor versions prior to 0.76.6, specifically within the `Windows.Collectors.Remapping` artifact. The vulnerability arises because the `hostname` field in `client_info.json` is inserted into a YAML template via Go's `text/template` without proper escaping, allowing an attacker to inject arbitrary VQL commands. If an analyst processes a malicious collection ZIP using the `--remap` flag, the injected code executes with `NullACLManager` privileges, granting full, unsandboxed access to the analyst's workstation. For EMEA financial services, this presents a severe supply-chain and insider-threat risk where compromised forensic data can pivot to compromise the incident response infrastructure itself. ## 2\. Regulatory framing | Regulation | Article | Practical Impact for Financial Entities | | ---------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **DORA** | Art. 17 | Requires immediate classification of this incident as a "major" ICT-related incident if exploitation leads to unauthorized data access or system compromise, triggering strict reporting timelines to competent authorities. | | **DORA** | Art. 19 | Mandates the implementation of specific patching procedures for the Velociraptor platform; failure to upgrade to v0.76.6+ constitutes a gap in the ICT risk management framework. | | **DORA** | Art. 28-30 | Highlights third-party risk; financial entities using Velociraptor must verify their vendor's remediation status and ensure their own usage of the \--remap function adheres to strict input validation policies. | | **NIS2** | Art. 21(2)(d) | Obliges entities to implement policies for vulnerability handling and disclosure; the use of unescaped user input in core tooling violates basic supply chain security requirements. | | **NIS2** | Art. 23 | Requires entities to assess the impact of this vulnerability on their essential services and report any successful exploitation that disrupts service availability or integrity. | ## 3\. Attack chain 1. **Preparation:** An attacker creates a malicious ZIP file containing a crafted `client_info.json`. 2. **Injection:** The attacker manipulates the `hostname` field within the JSON to include literal double quotes and newlines, breaking the YAML quoted string context. 3. **Delivery:** The malicious ZIP is introduced to the environment (e.g., uploaded as a purported forensic collection from a compromised endpoint or provided by a threat actor posing as a partner). 4. **Trigger:** A security analyst or automated process executes the Velociraptor remapping function using the `--remap` flag against the malicious collection. 5. **Execution:** The unsanitized hostname injects a new mount remapping entry, causing arbitrary VQL (Velociraptor Query Language) to execute on the analyst's machine. 6. **Privilege Escalation:** The injected VQL runs under `NullACLManager`, bypassing all permission checks and sandboxing. *Unconfirmed steps:* The specific mechanism by which the malicious ZIP is initially delivered to the analyst (e.g., phishing email vs. compromised endpoint ingestion) is not specified in the source material and depends on the specific operational context of the victim organization. Attribution of any active exploitation campaigns is currently unknown. ## 4\. Mitigation & containment **P1 (Within 24h): Operational Containment** \* **Disable Remapping:** Immediately cease usage of the `--remap` flag in all Velociraptor workflows until validation is complete. \* **Input Validation:** Implement a gateway check or manual review process for any `client_info.json` files before they are processed by Velociraptor instances. Look for newlines (`\n`) or unescaped quotes within the `hostname` field. \* **Isolate Analyst Workstations:** If `--remap` has been used on untrusted collections in the last 30 days, isolate those analyst workstations for forensic review, assuming potential full compromise. **P2 (Within 72h): Remediation** \* **Upgrade Vendor Tool:** Upgrade Rapid7 Velociraptor to version **0.76.6** or later immediately. This version contains the fix for the YAML injection. \* *Command (Linux/Systemd):* `systemctl stop velociraptor && apt-get install velociraptor=0.76.6 && systemctl start velociraptor` (Adjust for specific package manager). \* *Command (Windows):* Download the latest MSI from the official Rapid7/Velociraptor release page and execute with administrative privileges. \* **Version Pinning:** Enforce version pinning in deployment scripts to prevent rollback to vulnerable versions (< 0.76.6). **P3 (Within 7 days): Process Hardening** \* **Policy Update:** Update Incident Response playbooks to explicitly forbid the use of `--remap` on collections from unverified or low-trust sources. \* **Supply Chain Review:** Audit all third-party forensic and DFIR tools for similar template injection vulnerabilities where user-controlled data is merged into configuration files. ## 5\. Indicators of compromise No specific file hashes, domains, or IP addresses associated with active exploitation are available in the source material. The indicator is the presence of a specific malformed structure within a legitimate file type. ```iocs filename client_info.json field_name hostname flag --remap version_affected < 0.76.6 ``` ## 6\. Detection The following rules detect the specific conditions required for exploitation: the use of the vulnerable flag and the presence of newline characters within the hostname field of a JSON file. ```yara rule Velociraptor_YAML_Injection_Attempt { meta: author = "Adverse Trace" date = "2026-06-09" reference = "https://github.com/advisories/GHSA-6jwp-vhch-qjpr" description = "Detects potential YAML injection payload in client_info.json hostname field targeting Velociraptor" cve = "CVE-2026-8795" strings: $json_key = "\"hostname\"" ascii $newline_injection = "\"\n" ascii $breakout = "\"\n " ascii // Typical YAML breakout pattern condition: filename =~ /client_info\.json$/ and ($json_key and ($newline_injection or $breakout)) } ``` ```yaml title: Velociraptor Remap Flag Usage id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d status: experimental description: Detects execution of Velociraptor with the --remap flag, which triggers the vulnerable code path in versions < 0.76.6. author: Adverse Trace date: 2026/06/09 references: - https://github.com/advisories/GHSA-6jwp-vhch-qjpr logsource: category: process_creation product: windows detection: selection: Image|endswith: '\velociraptor.exe' CommandLine|contains: '--remap' condition: selection level: high tags: - attack.execution - cve.2026.8795 ``` ## 7\. Sources - GitHub Advisory Database, "A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7...", https://github.com/advisories/GHSA-6jwp-vhch-qjpr, 2026-06-09. - National Vulnerability Database, "CVE-2026-8795", https://github.com/advisories/GHSA-6jwp-vhch-qjpr, 2026-06-09. ## 8\. Adverse Trace position We assess the severity of CVE-2026-8795 as **High** for any EMEA financial institution utilizing Rapid7 Velociraptor versions prior to 0.76.6 for incident response or threat hunting. The risk is compounded by the fact that exploitation results in `NullACLManager` privileges, effectively handing an attacker the keys to the analyst's workstation and potentially the broader Velociraptor cluster if network segmentation is weak. While no active exploitation in the wild has been confirmed in the source material, the simplicity of the exploit (crafting a JSON file) makes it highly weaponizable. Our team will monitor threat intelligence feeds for signs of weaponization and assist clients in validating their Velociraptor deployment versions and remapping workflows. --- [Read the original source →](https://github.com/advisories/GHSA-6jwp-vhch-qjpr?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*