Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.
The user must designate the column to be of type URL in the notebook, or in the artifact. Currently the only built in artifact that does this is Server.Monitoring.RSSFeeds.
Users should not designate a column as type URL if the source of the table is untrusted (e.g. the results from artifact collections where the data is under the attacker's control).