CVE-2026-15371
Received Received - Intake

JavaScript Scheme XSS in Velociraptor Web GUI

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Rapid7, Inc.

Description
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-15371
EUVD
EUVD-2026-60571

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
velociraptor velociraptor to 0.77.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-177 The product does not properly handle when all or part of an input has been URL encoded.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Velociraptor's web GUI. It occurs when users specify a custom column type as URL. The application does not restrict URL schemes, allowing attackers to input a JavaScript scheme. This leads to stored XSS attacks where malicious scripts execute when others view the table.

Detection Guidance

Check Velociraptor versions before 0.77.2 on Linux. Inspect Server.Monitoring.RSSFeeds artifact for URL-type columns with untrusted data sources. Look for JavaScript scheme usage in URL columns.

Impact Analysis

An attacker could inject malicious JavaScript via a JavaScript URL scheme in a URL-type column. When users view the affected table, the script executes, potentially stealing session cookies, redirecting users, or performing actions on their behalf. This requires high privileges and user interaction but allows network-based attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Stored XSS may enable attackers to exfiltrate personal or health information, resulting in non-compliance with data protection regulations.

Mitigation Strategies

Upgrade to Velociraptor version 0.77.2 or later. Avoid designating columns as URL type if the data source is untrusted. Remove or sanitize any existing URL-type columns with JavaScript schemes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15371. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart