An argument injection vulnerability in hashcat versions 7.1.2 and earlier allows attackers to manipulate command-line arguments via malicious restore files.

This is an Improper Neutralization of Argument Delimiters in a Command (CWE-88) vulnerability. The application fails to validate options when reading restore files, allowing an attacker to inject arguments such as --outfile or --potfile-path, which can lead to unauthorized file overwrites or data redirection.

The ability to redirect output or overwrite files can be leveraged to corrupt system files or capture sensitive hash results in unauthorized locations. With a CVSS score of 7.8, this vulnerability represents a high risk to the confidentiality and integrity of data processed by the hashcat utility.

Immediate Action: Upgrade to a version of hashcat released after 7.1.2 that contains the fix for the restore file parsing logic.

Proactive Monitoring: Audit the file system for unexpected files created or modified by the hashcat process, specifically those located in sensitive directories.

Compensating Controls: Ensure that restore files are only loaded from trusted locations and that the user running hashcat has the minimum necessary file system permissions.

Public Exploit Available: No (exploit_available: false)

The risk posed by argument injection is significant, as it can lead to unauthorized file modification. Users of hashcat should upgrade to the latest version immediately to ensure that command-line argument parsing is properly restricted.