Stored XSS via unrestricted URL schemes

Stored XSS in Rapid7 Velociraptor before 0.77.2 allows remote authenticated users to run script in a victim browser via a crafted URL cell. In the web GUI, the URL column type turns cell data into a clickable link, and the patched href helper shows the flaw by newly rejecting any scheme other than empty, http, or https, meaning earlier code let javascript: values pass through into the page. Exposure requires a privileged user to mark a notebook or artifact column as type URL and another GUI user to click the rendered link; the vendor notes Server.Monitoring.RSSFeeds is a built-in path that uses this column type.