CVE-2026-15371: Velociraptor Stored XSS in URL column types

Published on 2026-07-31 Vulnogram
CVSS · HIGH · 8.1 ⁄10 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Scoring scenario: GENERAL
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
Description

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.

The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.

Problem CWE-177 Improper handling of URL encoding (hex encoding)
Required configuration for exposure The user must designate the column to be of type URL in the notebook, or in the artifact. Currently the only built in artifact that does this is Server.Monitoring.RSSFeeds.
Workarounds Users should not designate a column as type URL if the source of the table is untrusted (e.g. the results from artifact collections where the data is under the attacker's control).
ProductAffected
Rapid7 Velociraptor on Linux
source repo
Default status is unaffected 		before 0.77.2
Credits
  • yoojoon2 (https://github.com/yoojoon2)
    •
References