Jester@OthalaBS
@Edover45 https://shellcode.blog/finding-cve-with-claude-velociraptor-cve-2026-8795/ Or start at claude them self https://www.anthropic.com/research/zero-days
00014395
54 followersView on X
CVE-2026-8795Disclosure
LOWCVSS 7.8 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostname field in client_info.json inside a collection ZIP is inserted into a YAML template via Go's text/template without escaping. An attacker providing a crafted collection ZIP can leverage literal double quotes and newlines in the hostname to break out of the YAML quoted string and inject a new mount remapping entry. When an analyst applies the generated remapping file with --remap, arbitrary VQL executes on their machine with NullACLManager (all permissions granted, unsandboxed).
0.0/ 10 priority
Sources & remediation
Weakness type (CWE)
CWE-74CWE-94CWE-116
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- Technical details provided in 1 signal
- Disclosure: 1 classified signal
- 1 total mentions across 1 day
Deep dive
Activity timeline1 mentions / 1d
Signal classification1 categories
Disclosure1100.0%
Referenced assets1 URL
By indicator
Full discourse2 posts
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValtersDisclosureCVE-2026-8795 - Supply chain attack via YAML injection in Rapid7 Velociraptor. Crafted hostname in client_info.json breaks YAML string, injects mount remaps. CVSS 7.8. No patch yet. Monitor vendors. #CVE #infosec #Rapid7 #CyberCommunity #developers FREE: https://www.valtersit.com/cve/CVE-2026-8795/
Post summary
The post discloses CVE-2026-8795, a YAML injection supply‑chain flaw in Rapid7 Velociraptor, detailing its attack vector and severity while noting no patch has been released and no active exploitation is reported.
0000075921 followersView on X