CVE-2025-0914: Velociraptor Shell Plugin Prevent_execve Bypass
An improper access control issue in the VQL shell feature in Velociraptor Versions < 0.73.4 allowed authenticated users to execute the execve() plugin in deployments where this was explicitly forbidden by configuring the preventexecve flag in the configuration file. This setting is not usually recommended and is uncommonly used, so this issue will only affect users who do set it. This issue is fixed in release 0.73.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0914?
CVE-2025-0914 has been classified as a high severity vulnerability.
How do I fix CVE-2025-0914?
To remediate CVE-2025-0914, upgrade Velociraptor to version 0.73.4 or later.
Who is affected by CVE-2025-0914?
CVE-2025-0914 affects users of Velociraptor versions prior to 0.73.4.
What does CVE-2025-0914 allow an attacker to do?
CVE-2025-0914 allows authenticated users to execute the execve() plugin despite its intended restrictions.
Is there a workaround for CVE-2025-0914?
There is no recommended workaround for CVE-2025-0914; upgrading to the latest version is advised.