hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.

CVE-2026-68766 describes a vulnerability in hashcat where the application fails to restrict command-line options when parsing restore files. Attackers can craft malicious restore files that inject output-redirecting options such as --outfile and --potfile-path. This allows appending attacker-controlled content to arbitrary files on the system. The vulnerability can lead to code execution when attackers target shell startup files such as .bashrc or .profile. The flaw exists in hashcat's restore.c source file around lines 365-369. A fix was committed to the hashcat repository and is available in versions after v7.1.2. The issue was also tracked in hashcat's GitHub issue tracker as issue #4738. VulnCheck published an advisory detailing the attack vector and impact. This represents a significant security risk for systems where untrusted restore files could be introduced.