CVE-2026-19200

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI. The code does not limit the schemes allowed in this URL, allowing an attacker to specify a JavaScript scheme exposing the user to XSS.

Velociraptor fails to sanitize data when exporting to CSV, which can lead to formula execution by Microsoft Excel during import. Cells starting with certain characters are treated as formulas, allowing arbitrary code execution.

The hunt_delete() VQL function in Velociraptor allows deleting hunts. Velociraptor misapplied the permission check, requiring only COLLECT_CLIENT (usually assigned to the 'investigator' role) instead of the DELETE_RESULTS permission (usually only assigned to administrators).

A rogue Velociraptor client can upload a malformed sparse file that causes a panic when the GUI attempts to expand it, potentially crashing the server process. The issue is a Divide by Zero bug in the ShouldPadFile() function.

Velociraptor allows reading Stacked result sets from the GUI due to incorrect path validation against the prefix deny list. A user with read access to the root org can access result sets from child orgs.

Velociraptor allows scheduling new collections via VQL queries in notebooks. The COLLECT_CLIENT permission is required, but it is not enforced when the user can run a VQL query that resets the authorization provider. A user with the analyst role can launch new collections, which usually require the investigator role, leading to privilege escalation.

The NewNotebook API does not sufficiently sanitize its parameters, allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can overwrite other metadata files, causing data corruption.

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdPs allow users to change the email claim without verification, and some do not set the "email_verified" claim. This allows a user to impersonate another user by setting their email address within the IdP, enabling account takeover.

Any authenticated Velociraptor user, including one holding only the reader role, can terminate the entire server process with a single request by calling SetPassword with a username that does not exist.

Velociraptor allows an administrator of a child org to delete other orgs because it checks the ORG_ADMIN permission in the calling org instead of the ROOT org.