Overview

CVE-2026-15371 is a vulnerability in Velociraptor, a security tool used for endpoint monitoring and response. Velociraptor's web GUI allows users to specify custom types for columns in tables, including a URL type that forms clickable URLs. However, the code does not limit the schemes allowed in these URLs, enabling an attacker to specify a JavaScript scheme and expose users to cross-site scripting (XSS).

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of this vulnerability is a design issue in Velociraptor's web GUI. Specifically, the code does not properly validate or limit the schemes used in URLs, allowing an attacker to inject malicious JavaScript code. This vulnerability belongs to the CWE-177 category.

Attack Surface & Vector

The attack surface for this vulnerability is the Velociraptor web GUI, specifically the feature that allows users to specify custom types for columns in tables. An attacker can reach this vulnerability by crafting a malicious URL with a JavaScript scheme, which can be clicked in the GUI. The preconditions needed for this attack are:

  • The attacker must have access to the Velociraptor web GUI.
  • The attacker must be able to craft a malicious URL with a JavaScript scheme.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Velociraptor User's Session

Initial Position: An attacker gains access to the Velociraptor web GUI, either through a vulnerable user account or by exploiting another vulnerability.

Triggering the Flaw: The attacker crafts a malicious URL with a JavaScript scheme, which is allowed by the Velociraptor web GUI. This URL is designed to inject malicious JavaScript code into the user's browser.

What Breaks: When the user clicks on the crafted URL, the JavaScript code is executed, allowing the attacker to hijack the user's session or perform other malicious actions. The security boundary fails because the Velociraptor web GUI does not properly validate or limit the schemes used in URLs.

Attacker's Prize: The attacker gains control of the user's session, allowing them to access sensitive information, modify configurations, or perform other malicious actions.

Real-World Impact

The impact of this vulnerability can be significant, as an attacker can use it to gain unauthorized access to sensitive information or disrupt the operation of the Velociraptor tool. If actively exploited in the wild, this vulnerability could lead to:

  • Unauthorized access to sensitive information.
  • Modification of configurations or data.
  • Disruption of endpoint monitoring and response operations.

Detection & Defense

Immediate Mitigations

To mitigate this vulnerability, users should:

  • Upgrade Velociraptor to version 0.77.2 or later.

Detection Strategies

Defenders can detect exploitation attempts by:

  • Monitoring Velociraptor web GUI logs for suspicious URL activity.
  • Implementing network security controls to block malicious URLs.

Long-Term Hardening

To prevent similar vulnerabilities in the future, consider:

  • Implementing robust input validation and sanitization for user-input data.
  • Configuring Velociraptor to use a whitelist of allowed URL schemes.

Key Takeaways

  • CVE-2026-15371 is a high-severity vulnerability in Velociraptor that allows an attacker to inject malicious JavaScript code via a crafted URL.
  • The vulnerability is caused by a design issue in Velociraptor's web GUI, which does not properly validate or limit the schemes used in URLs.
  • Users should upgrade Velociraptor to version 0.77.2 or later to mitigate this vulnerability.
  • Defenders should monitor Velociraptor web GUI logs and implement network security controls to detect and prevent exploitation attempts.

Sources