CVE-2026-85737

Velociraptor versions prior to 0.77.2 are vulnerable to arbitrary outbound database connections due to a lack of plugin-level FILESYSTEM_READ or NETWORK checks in vql/parsers/sql/sql.go. The SQLPlugin.Call function fails to validate caller-controlled connection strings before they are passed to s...