Velociraptor's web GUI allows the administrator to define custom column types for tables. The URL type takes the cell value and renders it as a clickable link. However, the underlying code accepts any URL scheme without restriction. An attacker can embed a JavaScript scheme such as javascript:alert(1) in the data source, causing the browser to execute the script when a user clicks the link. This leads to stored cross‑site scripting that can steal session cookies, modify page content, or perform other malicious actions in the victim’s browser session.

All Rapid7 Velociraptor deployments that expose the web GUI and allow definition of URL column types are affected. The advisory does not list specific version numbers, implying that the issue exists in all supported releases until a patch is issued.

The CVSS score of 8.1 denotes a high severity vulnerability. Because the exploit requires no network‑level interaction beyond the normal operation of the web GUI, the likelihood of exploitation is elevated for organizations that provide users with the ability to model tables from untrusted data sources. The vulnerability is not currently listed in the CISA KEV catalog, and no EPSS value is available. Attackers would need to inject malicious data into a table column and trigger the link, so the threat vector is user interaction with the Velociraptor web interface.