This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-68766 →

DEBIAN-CVE-2026-68766

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and...

Original description

The description as published by the source.

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 hashcat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 hashcat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 hashcat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org