CVE-2026-15371

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...

CVE-2026-15371

Velociraptor's web GUI URL column type accepts arbitrary schemes (e.g., javascript:), enabling stored XSS when a victim clicks a crafted link. Root cause is lack of scheme allow-listing. CVSS 8.1 (HIGH) requires high privileges and user click. Exploitation in the wild is not reported. Advisory: h...

CVE-2026-15371 Velociraptor Stored XSS in URL column types

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...