AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Rapid7CVE-2026-15371

Rapid7 Velociraptor: cross-site scripting

Rapid7

CVE-2026-15371 · Published Aug 18, 2026 · updated Aug 28, 2026

High8.1
Fix: upgrade to 0.77.2 or later
Rapid7 advisory

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.

Affected versions

PackageAffectedFixed in
Velociraptor
Product
< 0.77.20.77.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-177

More Rapid7 advisories

All Rapid7
High 8.9Aug 24Rapid7 Velociraptor: code injectionCVE-2026-19200fixed in 0.77.2Low 3.5Aug 12A rogue Velociraptor client can upload a malformed sparse file suchCVE-2026-64951fixed in 0.77.2Medium 6.5Aug 12Rapid7 Velociraptor: improper authorizationCVE-2026-64952fixed in 0.77.2Medium 6.1Aug 12Rapid7 Velociraptor: CSV injectionCVE-2026-64955fixed in 0.77.2Medium 6.5Aug 12Rapid7 Velociraptor: missing authorizationCVE-2026-18652fixed in 0.77.2High 8.2Aug 12Rapid7 Velociraptor: missing authorizationCVE-2026-64954fixed in 0.77.2