CVE-2026-15371
High
Description
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.
SeverityHigh
CVSS8.1
Exploit probability—
ProductVelociraptor
PublishedAug 18, 2026
First seenAug 18, 2026
Weakness typeCWE-177CWE-177
How to fix
Update
- Rapid7 Velociraptor0.77.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Rapid7 Velociraptor | v < 0.77.2 | 0.77.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.