CVE-2025-0914 Velociraptor Shell Plugin Prevent_execve Bypass

An improper access control issue in the VQL shell feature in Velociraptor Versions 0.73.4 allowed authenticated users to execute the execve plugin in deployments where this was explicitly forbidden by configuring the preventexecve flag in the configuration file. This setting is not usually...

CVE-2025-0914

Velociraptor is affected: Versions earlier than 0.73.4 suffer improper access control in the VQL shell that permits authenticated users to trigger the execve() plugin even when prevent_execve is configured to forbid it. The issue is fixed in release 0.73.4. Practical impact is limited to deployme...