CVE-2026-15371
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI. The code does not limit the schemes allowed in this URL, allowing an attacker to specify a JavaScript scheme exposing the user to XSS.
Risk Assessment
The risk includes execution of malicious script in the user's browser, which can lead to session theft, data theft, or account takeover.
Recommendation
It is recommended to update Velociraptor to a patched version and restrict allowed URL schemes in column configuration.
Original NVD description (English source)
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.