{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/hashcat/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-68766"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["hashcat"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["hashcat"],"content_html":"\u003cp\u003eHashcat versions up to and including 7.1.2 are susceptible to an argument injection vulnerability (CVE-2026-68766) occurring during the parsing of restore files. This flaw allows an attacker to inject arbitrary command-line options, such as --outfile or --potfile-path, by crafting a malicious restore file. When a user runs hashcat with this file, the application processes these injected options without sufficient validation. An attacker can leverage this to redirect hashcat output to arbitrary locations on the filesystem. By targeting shell startup files (such as .bashrc, .profile, or .zshrc), an attacker can append malicious commands to these files, leading to arbitrary code execution when the victim next opens a shell. This vulnerability relies on the user performing a restore action, making it a viable target for local attackers or those capable of dropping files in directories where a user typically runs password recovery operations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker creates a malicious session restore file with injected command-line arguments (e.g., --outfile).\u003c/li\u003e\n\u003cli\u003eAttacker places the crafted restore file in a directory monitored or used by a target user for hashcat sessions.\u003c/li\u003e\n\u003cli\u003eVictim executes hashcat, pointing to the malicious restore file (e.g., hashcat --restore session.restore).\u003c/li\u003e\n\u003cli\u003eHashcat process parses the restore file and executes with the injected flags applied to its internal state.\u003c/li\u003e\n\u003cli\u003eHashcat writes its output or potfile data to the path specified by the attacker (e.g., ~/.bashrc).\u003c/li\u003e\n\u003cli\u003eThe injected payload is successfully appended to the target shell configuration file.\u003c/li\u003e\n\u003cli\u003eVictim starts a new shell session, triggering the execution of the appended commands.\u003c/li\u003e\n\u003cli\u003eAttacker-controlled code runs within the context of the user, achieving full arbitrary code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary code execution within the security context of the victim user. This could lead to full system compromise, data theft, or persistence on the host. The vulnerability affects all platforms (Windows, Linux, macOS) where hashcat 7.1.2 or earlier is deployed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to the latest version of hashcat (post-7.1.2) where the parsing logic for restore files has been restricted.\u003c/li\u003e\n\u003cli\u003eAudit hashcat session directories for unexpected restore file modifications, particularly in shared compute environments.\u003c/li\u003e\n\u003cli\u003eMonitor for processes spawning with unexpected command-line arguments derived from file inputs.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules below to detect suspicious hashcat command-line invocation patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-22T15:31:53Z","date_published":"2026-08-22T15:31:53Z","id":"https://feed.craftedsignal.io/briefs/2026-08-hashcat-restore-injection/","summary":"Hashcat is vulnerable to argument injection when parsing restore files, potentially leading to arbitrary code execution if a user restores a malicious session file.","title":"CVE-2026-68766: Argument Injection in Hashcat Restore Files","url":"https://feed.craftedsignal.io/briefs/2026-08-hashcat-restore-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Hashcat","version":"https://jsonfeed.org/version/1.1"}