Description

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-10T03:17:00.063Z",
  "pubdate": "2026-09-10T03:17:00.063Z",
  "executiveSummary": "This vulnerability involves an improper neutralization of special elements during the restoration process of notebook backups in Velociraptor. The issue stems from the unsafe interpolation of notebook cell content into execution templates, which lack necessary Access Control List (ACL) validation during restore operations.\nA malicious actor possessing the NOTEBOOK_EDITOR permission can inject arbitrary VQL (Velociraptor Query Language) code into notebook cells. This injected code remains dormant until the system triggers a restoration of the notebook backup. Upon restoration, the server-side engine processes the untrusted content with elevated administrative privileges, effectively bypassing standard authorization controls.\nThe impact is significant, as successful exploitation allows for arbitrary code execution within the context of the Velociraptor server. This grants an attacker the ability to interact with the underlying host system, access sensitive telemetry, exfiltrate data, or deploy persistent backdoors. The vulnerability requires existing low-privileged access (NOTEBOOK_EDITOR) to the platform, making it a critical escalation path for authenticated malicious insiders or compromised user accounts.",
  "technicalDetails": "The root cause of this vulnerability is a lack of input sanitization and secure deserialization practices within the Velociraptor notebook backup restoration mechanism. When the system performs a scheduled or manual restoration of notebook data, it improperly treats stored cell content as trusted input.\nThe attack flow proceeds as follows: First, a user with NOTEBOOK_EDITOR privileges crafts a notebook cell containing a malicious VQL payload designed to execute system-level commands or unauthorized data queries. This payload is stored within the notebook configuration during the daily backup cycle. Second, an administrative action triggers a restoration of these backup files. During this phase, the system reads the previously planted malicious VQL string and interpolates it directly into a template used for VQL evaluation.\nCrucially, this evaluation occurs without further ACL checks against the user who originally authored the malicious notebook content. Because the restoration process often runs under the context of the Velociraptor server process—which typically operates with high system privileges—the injected VQL is executed with those same elevated permissions, bypassing the restricted environment that would normally prevent an editor from performing such actions.\nThis flaw effectively allows an attacker to achieve privilege escalation, transitioning from a constrained NOTEBOOK_EDITOR role to full server-side command execution. The payload behavior is limited only by the capabilities of the VQL engine itself, which includes direct file system access, process execution, and network communication. Post-exploitation, the attacker can leverage the server's elevated permissions to compromise the entire Velociraptor infrastructure or pivot into the underlying host network."
}