CVE-2026-15371 PUBLISHED

Velociraptor Stored XSS in URL column types

Assigner: rapid7
Reserved: 10.07.2026 Published: 18.08.2026 Updated: 18.08.2026

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
CVSS Score: 8.1

Product Status

Vendor Rapid7
Product Velociraptor
Versions Default: unaffected
  • affected from 0 to 0.77.2 (excl.)

Affected Configurations

The user must designate the column to be of type URL in the notebook, or in the artifact. Currently the only built in artifact that does this is Server.Monitoring.RSSFeeds.

Workarounds

Users should not designate a column as type URL if the source of the table is untrusted (e.g. the results from artifact collections where the data is under the attacker's control).

Credits

  • yoojoon2 (https://github.com/yoojoon2) finder

References

Problem Types

  • CWE-177 Improper handling of URL encoding (hex encoding) CWE

Impacts

  • CAPEC-592 Stored XSS