Description

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-22T15:16:20.633Z",
  "pubdate": "2026-08-22T15:16:20.633Z",
  "executiveSummary": "Hashcat suffers from an improper command-line option restriction vulnerability when parsing restore files.\nThe vulnerability allows an attacker to inject arbitrary command-line options, specifically output-redirecting parameters such as --outfile and --potfile-path.\nThe primary impact of this flaw is arbitrary file write, enabling attackers to append attacker-controlled content to sensitive files on the system.\nWhen successfully chained with targets such as shell startup files, this vulnerability can lead to arbitrary code execution within the context of the user running hashcat.\nThe affected product is hashcat, specifically related to its session restoration functionality.\nExploitation requires an attacker to craft a malicious restore file and trick a user into loading it or placing it in a location where hashcat automatically parses it.\nThe risk implications are significant as it elevates file write capabilities into potential system compromise via environment manipulation.",
  "technicalDetails": "The root cause of the vulnerability lies in the insecure parsing and handling of command-line options stored within hashcat restore files.\nWhen hashcat attempts to resume a session using a restore file, it fails to properly sanitize or restrict the parameters being read and subsequently executed as part of the operational configuration.\nThis lack of validation permits the insertion of administrative or configuration switches that were intended to be controlled exclusively by the executing user via the initial command-line interface.\nSpecifically, an attacker can manipulate the restore file structure to inject options like --outfile and --potfile-path.\nThe attack flow proceeds as follows: First, the attacker crafts or modifies a hashcat restore file to include malicious option strings designed to redirect output destinations. Second, the victim executes hashcat, pointing it to the malicious restore file or allowing hashcat to parse it during session recovery. Third, hashcat processes the file and applies the injected parameters, altering internal operational variables governing where data is written. Fourth, during the cracking process, generated output or session data is appended to the file path specified by the attacker via the injected options. Finally, by targeting shell startup files such as ~/.bashrc or ~/.zshrc, the attacker achieves arbitrary code execution upon the subsequent initialization of the victim shell environment.\nThe vulnerable component is the restore file parser within hashcat.\nAuthentication and network exposure requirements are not applicable as the attack vector is strictly local, relying on file system manipulation or user interaction.\nPrivilege requirements are limited to the access rights of the user executing hashcat, allowing the modification of any files writable by that user.\nThe payload behavior involves appending arbitrary hashcat output streams into targeted victim files to achieve persistence or code execution."
}