CVE-2025-0914
Velociraptor Shell Plugin Prevent_execve Bypass
An improper access control issue in the VQL shell feature in Velociraptor Versions < 0.73.4 allowed authenticated users to execute the execve() plugin in deployments where this was explicitly forbidden by configuring the prevent_execve flag in the configuration file. This setting is not usually recommended and is uncommonly used, so this issue will only affect users who do set it. This issue is fixed in release 0.73.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Velociraptor Shell Plugin Prevent_execve Bypass
An improper access control issue in the VQL shell feature in Velociraptor Versions < 0.73.4 allowed authenticated users to execute the execve() plugin in deployments where this was explicitly forbidden by configuring the prevent_execve flag in the configuration file. This setting is not usually recommended and is uncommonly used, so this issue will only affect users who do set it. This issue is fixed in release 0.73.4.
- Record
CVE-2025-0914- CVSS 3.1
- 3.8 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-281
- Updated
- 2026-11-02
EUVDEUVD-2025-5451
An improper access control issue in the VQL shell feature in Velociraptor Versions < 0.73.4 allowed authenticated users to execute the execve() plugin in deployments where this was explicitly forbidden by configuring the prevent_execve flag in the configuration file. This setting is not usually recommended and is uncommonly used, so this issue will only affect users who do set it. This issue is fixed in release 0.73.4.
- Record
EUVD-2025-5451- CVSS 3.1
- 3.8 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3q7x-q7fm-whrm
An improper access control issue in the VQL shell feature in Velociraptor Versions < 0.73.4...
An improper access control issue in the VQL shell feature in Velociraptor Versions < 0.73.4 allowed authenticated users to execute the execve() plugin in deployments where this was explicitly forbidden by configuring the prevent_execve flag in the configuration file. This setting is not usually recommended and is uncommonly used, so this issue will only affect users who do set it. This issue is fixed in release 0.73.4.
- Record
GHSA-3q7x-q7fm-whrm- CVSS 3.1
- 3.8 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-281
- Updated
- 2026-11-02
NVD
An improper access control issue in the VQL shell feature in Velociraptor Versions < 0.73.4 allowed authenticated users to execute the execve() plugin in deployments where this was explicitly forbidden by configuring the prevent_execve flag in the configuration file. This setting is not usually recommended and is uncommonly used, so this issue will only affect users who do set it. This issue is fixed in release 0.73.4.
- Record
CVE-2025-0914- CVSS 3.1
- 3.8 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-281
- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12070-1No score
velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media
These are all security issues fixed in the velociraptor-0.76.7.0.git145.b60ef1146-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12070-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
velociraptoropenSUSE:Tumbleweed From an advisory covering 40 CVEs | before 0.76.7.0.git145.b60ef1146-1.1 | 0.76.7.0.git145.b60ef1146-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-0914 is a low vulnerability (CVSS 3.8) in Rapid7 Velociraptor, published February 27, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. No source names a fixed version.
References
docs.velociraptor.app/announcements/advisories/cve-2025-0914
nvd.nist.gov/vuln/detail/CVE-2025-0914
github.com/advisories/GHSA-3q7x-q7fm-whrm
suse.com/security/cve/CVE-2025-0914
Show 37 moreShow less