CVE-2026-15371: Velociraptor Stored XSS in URL column types
Published Aug 18, 2026
·Updated
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.
Affected Software
1 affected component
Velociraptor Velociraptor web GUI
Event History
Aug 18, 2026
CVE Published
via MITRE·06:52 AM
Data Sourced
via MITRE·06:52 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access and user interaction are required for exploitation?
An attacker needs high privileges and must be able to configure a table column with the URL type and supply a crafted cell value. Exploitation also requires a user to interact with the resulting link in the web GUI.
2
Which GUI configurations are affected?
The issue is exposed through tables whose columns are configured with the URL type. Those URLs are not restricted to safe schemes, so a crafted JavaScript-scheme value can execute script when clicked.