Description
Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed in version 0.7.0-04 and a patch is available to download. Patches are also available for version 0.6.9 (0.6.9-1).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rapid7 | Velociraptor | < 0.7.0-4 | 0.7.0-4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | velociraptor | 0.7.0.4.git74.3426c0a-5.1 | openSUSE-SU-2024:13830-1 |
Advisories 1
- openSUSE-SU-2024:13830-1 system-user-velociraptor-1.0.0-5.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026