CVE-2026-15371: Velociraptor Stored XSS in URL column types
Published on 2026-07-31
Vulnogram
CVSS · HIGH · 8.1 ⁄10 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Scoring scenario:
GENERAL
attackVector:
NETWORK
attackComplexity:
LOW
privilegesRequired:
HIGH
userInteraction:
REQUIRED
scope:
CHANGED
confidentialityImpact:
HIGH
integrityImpact:
HIGH
availabilityImpact:
NONE
Description
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.
The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.
Problem
CWE-177 Improper handling of URL encoding (hex encoding)
Required configuration for exposure
The user must designate the column to be of type URL in the notebook, or in the artifact. Currently the only built in artifact that does this is Server.Monitoring.RSSFeeds.
Workarounds
Users should not designate a column as type URL if the source of the table is untrusted (e.g. the results from artifact collections where the data is under the attacker's control).
| Product | Affected |
|---|---|
| Rapid7 Velociraptor on
Linux
source repo Default status is unaffected |
before 0.77.2 |
Credits
- yoojoon2 (https://github.com/yoojoon2)