CVE-2026-15371: Velociraptor Web GUI XSS Vulnerability

CVE-2026-15371 Overview

CVE-2026-15371 is a stored Cross-Site Scripting (XSS) vulnerability in the Velociraptor digital forensics and incident response platform. The web graphical user interface (GUI) allows users to specify a custom type for columns in tables. The URL type takes the cell value and forms a clickable link inside the GUI. The code does not restrict the URI schemes allowed in this link, so an attacker can supply a javascript: scheme. When another user clicks the crafted link, arbitrary JavaScript executes in the victim's browser session against the Velociraptor console.

Critical Impact
An authenticated attacker can inject javascript: URLs into tables, hijack analyst sessions, and pivot to code execution across investigated endpoints via the Velociraptor console.

Affected Products

Velociraptor DFIR platform (web GUI component)
Deployments exposing analyst-authored artifacts or tables to other console users
Multi-tenant Velociraptor instances where hunt results are shared between analysts

Discovery Timeline

2026-08-18 - CVE-2026-15371 published to the National Vulnerability Database (NVD)
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-15371

Vulnerability Analysis

Velociraptor renders artifact and hunt results in tabular form inside its React-based web GUI. Analysts can annotate table columns with a custom type, including a url type that converts each cell value into a clickable hyperlink. The rendering logic accepts the cell value as the anchor href without validating the URI scheme. Any string that browsers parse as a URL, including javascript: pseudo-URLs, is accepted.

When a second user clicks the link in the console, the browser evaluates the JavaScript payload in the origin of the Velociraptor GUI. The attacker inherits the victim's authenticated session, application programming interface (API) tokens, and any server-side privileges exposed to that role. Because Velociraptor operators frequently hold administrative permissions on collected endpoints, session takeover can escalate into arbitrary VQL execution across the fleet. This weakness is categorized under CWE-177: Improper Handling of URL Encoding.

Root Cause

The root cause is missing allowlist validation on URI schemes rendered by the url column type. The GUI trusts analyst-provided content and passes it directly to an anchor element. Safe schemes such as http, https, mailto, and ftp are not enforced.

Attack Vector

Attack requires an authenticated user with high privileges to author artifacts, notebooks, or hunts, and a second user must click the crafted cell. Successful exploitation crosses a security boundary because the payload executes in the victim's session context. See the Velociraptor CVE-2026-15371 Advisory for vendor-supplied technical details.

No verified proof-of-concept code is available. The vulnerability is
triggered by placing a value such as javascript:<payload> into a table
cell that is rendered by the GUI's URL column type. Refer to the vendor
advisory for reproduction details.

Detection Methods for CVE-2026-15371

Indicators of Compromise

Table cell values, notebook entries, or artifact outputs containing the strings javascript:, data:text/html, or vbscript: inside Velociraptor result stores
Unexpected VQL queries or artifact collections initiated from analyst sessions immediately after a table view was opened
New or modified custom artifacts referencing url column types authored by unusual accounts

Detection Strategies

Review Velociraptor server audit logs for artifact and notebook edits that introduce url column type declarations.
Query stored hunt and notebook results for cell values matching non-http(s) URI schemes.
Inspect browser Content Security Policy (CSP) violation reports from Velociraptor console users for blocked inline script executions.

Monitoring Recommendations

Forward Velociraptor server logs to a centralized logging platform and alert on artifact creation by non-administrative roles.
Monitor outbound API activity from Velociraptor operator workstations for anomalous session token reuse.
Track console login events correlated with new VQL executions occurring within seconds of table views.

How to Mitigate CVE-2026-15371

Immediate Actions Required

Upgrade Velociraptor to the fixed release identified in the vendor advisory as soon as it is available in your change window.
Restrict artifact, notebook, and hunt authoring permissions to a small set of trusted operators until patched.
Audit existing artifacts and notebooks for url column types and remove any cell values that use non-http(s) schemes.

Patch Information

Refer to the Velociraptor CVE-2026-15371 Advisory for the patched version and upgrade instructions. Apply the fixed release across all Velociraptor server instances and rotate any API tokens that may have been exposed to console users during the vulnerable window.

Workarounds

Limit the artifact_writer and equivalent roles so only vetted operators can define custom column types.
Instruct analysts to avoid clicking hyperlinks inside tables until the server is patched.
Deploy a strict Content Security Policy at the reverse proxy in front of Velociraptor to block javascript: navigation and inline script execution.

bash

# Example reverse-proxy CSP header blocking javascript: URLs in the GUI
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; base-uri 'self'; frame-ancestors 'none'; navigate-to 'self' https:;" always;