Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Velociraptor's web interface permits users to define custom column types for table displays, including a URL type that renders clickable links from cell values. The vulnerability stems from insufficient validation of URL schemes—the application fails to restrict which protocols are allowed. An attacker can inject a javascript: scheme, transforming a seemingly innocent table cell into a vector for cross-site scripting (XSS) attacks. This affects any organization using Velociraptor's web GUI, particularly incident responders and forensic analysts who rely on the interface to visualize endpoint data. With a CVSS score of 8.1, the high severity reflects the potential for attackers to execute arbitrary JavaScript within the context of an authenticated user's browser session, potentially compromising investigations or exfiltrating sensitive forensic data.
While this CVE maps to CWE-177 (Improper Handling of URL Encoding) rather than specific MITRE ATT&CK techniques, Casky's Claude-powered platform would detect attack patterns associated with client-side exploitation and persistence mechanisms. A practitioner using Casky would identify findings related to Execution techniques (T1203 - Exploitation for Client Execution) and Credential Access scenarios where malicious JavaScript could harvest session tokens or authentication data. The skill analysis would flag unsafe URL handling in web applications, particularly focusing on input validation gaps in custom type definitions. Extended reasoning would surface that this vulnerability requires user interaction (clicking the malicious link) within a trusted administrative interface, making it particularly dangerous in forensic workflows where analysts may not scrutinize every cell value. Practitioners would see recommendations for implementing URL scheme whitelisting (http, https only) and content security policies to prevent javascript: execution—security controls that Casky's skill mapping would prioritize in remediation guidance.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-15371. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation