TI-2021-02565 Aliases CVE-2021-3619 GHSA-m6q8-qh76-5hfr

Rapid7 Velociraptor Notebooks Authenticated Persistent XSS

LOW 23CWE-79Published 2021-08-17 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype sniffing to embed executable code on a malicious upload. This issue was fixed in version 0.6.0. Note that login rights to Velociraptor is nearly always reserved for trusted and verified users with IT security backgrounds.

Why it matters now

EPSS 0.00578 47th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Rapid7	Velociraptor	0.5.9 – 0.5.9	—	No fix listed	CNA

Velociraptor VendorRapid7 Affected 0.5.9 – 0.5.9 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:rapid7:velociraptor::::::::	before 0.6.0	Vulnerable	Rapid7

cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:* Versions before 0.6.0 Vulnerable ·Rapid7

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-3619
2026-10-03 Alias added: GHSA-m6q8-qh76-5hfr

References

Patch 1

https://github.com/Velocidex/velociraptor/pull/1118

Advisory 1

https://github.com/Velocidex/velociraptor/releases/tag/v0.6.0

TI-2023-05481 Rapid7 Velociraptor Reflected XSS CVSS 3.1HIGH 8.6
TI-2026-05514 Velociraptor Query() Plugin Misapplies Permissions To Orgs CVSS 3.1CRITICAL 9.1
TI-2026-04661 Rapid7 Velociraptor Improper Input Validation in Client Message Handler CVSS 3.1HIGH 8.5
TI-2023-00229 Insufficient permission check in the VQL copy() function CVSS 3.1HIGH 8.8
TI-2026-06659 GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations CVSS 3.1HIGH 7.7
TI-2025-13446 Rapid7 Velociraptor Directory Traversal Vulnerability CVSS 3.1MEDIUM 6.8

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences