2vulnerabilities
- Critical1 (50.0%)
- High1 (50.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
velocityjs
Ecosystem: npm
Downloads:
- 1CriticalAffects 1 version
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting velocityjs, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-7gfh-x38p-prh3 | Critical | Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)### Summary Remote Code Execution (RCE) in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq ("Prototype Pollution in #set path assignment") — that advisory blocked constructor/__proto__/prototype only in the #set assignment handler (set.cjs), but property read expressions are unfiltered. Any application rendering attacker-controlled Velocity templates is vulnerable to arbitrary code execution on the server. ### Details GHSA-j658-c2gf-x6pq added isBlockedPathKey() to dist/cjs/compile/set.cjs:35-43, which blocks __proto__, construc |
| GitHub (opens in a new tab) | |
| GHSA-j658-c2gf-x6pq | High | Velocity.js has a Prototype Pollution vulnerability through #set path assignment### Summary A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment. ### Details The root cause is located in the #set path assignment logic within the source code: - File: /src/compile/set.ts - Issue: The engine accepts arbitrary path keys and performs assignments using the |
| GitHub (opens in a new tab) |
- GHSA-7gfh-x38p-prh3CriticalVelocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
< 2.1.7
### Summary Remote Code Execution (RCE) in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq ("Prototype Pollution in #set path assignment") — that advisory blocked constructor/__proto__/prototype only in the #set assignment handler (set.cjs), but property read expressions are unfiltered. Any application rendering attacker-controlled Velocity templates is vulnerable to arbitrary code execution on the server. ### Details GHSA-j658-c2gf-x6pq added isBlockedPathKey() to dist/cjs/compile/set.cjs:35-43, which blocks __proto__, construc
CVE: CVE-2026-73649
- GHSA-j658-c2gf-x6pqHighVelocity.js has a Prototype Pollution vulnerability through #set path assignment
<= 2.1.5
### Summary A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment. ### Details The root cause is located in the #set path assignment logic within the source code: - File: /src/compile/set.ts - Issue: The engine accepts arbitrary path keys and performs assignments using the
CVE: CVE-2026-44966