CVE-2026-15371 — Velociraptor Stored XSS in URL column types
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not…
Published: 2026-08-18 · CVSS: 8.1 · CVSS 3.1
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7