4 matches found
GHSA-9QQ5-422F-33C2 Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin
Summary The sql VQL plugin runs a caller-supplied database driver and connection string with no permission check vql/parsers/sql/sql.go:93, SQLPlugin.Call. For driver='mysql' or driver='postgres' the handle comes from GetHandleOther sql.go:39, which passes the connection string straight to Go...
Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin
Summary The sql VQL plugin runs a caller-supplied database driver and connection string with no permission check vql/parsers/sql/sql.go:93, SQLPlugin.Call. For driver='mysql' or driver='postgres' the handle comes from GetHandleOther sql.go:39, which passes the connection string straight to Go...
CVE-2026-85737 Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin
Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language VQL queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEMREAD or NETWORK checks before the mysql and postgres branches pass a caller-controlle...
CVE-2026-85737 Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin
Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language VQL queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEMREAD or NETWORK checks before the mysql and postgres branches pass a caller-controlle...