Velocity.js CVE-2026-44966
CRITICAL
GHSA-j658-c2gf-x6pq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify endpoint rendering user-supplied template
-
DeliverySubmit template with #set($__proto__...) directive
-
ExploitEngine assigns key onto Object.prototype
-
ExecutionGlobal prototype polluted process-wide
-
ImpactTrigger DoS or chain gadget to RCE
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V3 - Web Frontend Security Prototype pollution prevention
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the application pass attacker-influenced content into the Velocity template body (the template string itself), not merely into the data context - the injected #set directive must be parsed by the engine. The specific trigger is a #set directive referencing a prototype-chain key such as $__proto__, constructor, or prototype (e.g. |
| Impact | The signals conflict and warrant tempering the headline CVSS 9.8. The provided vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects worst-case library misuse where a remote unauthenticated attacker fully controls template input and full C/I/A impact (RCE) is realized. However, that C:H/I:H/A:H rests on the advisory's own hedge - RCE is only possible 'depending on the server environment' and typically requires chaining with a gadget - so confidentiality/RCE impact is conditional rather than guaranteed. The concrete, always-available impact is prototype corruption leading to DoS and integrity/security-control bypass. EPSS is 0.08% (23rd percentile), the CVE is NOT in CISA KEV, and no vendor-released patch exists, but a reliable PoC is public. Net: a legitimate high-severity library flaw for any app that renders untrusted Velocity templates, but real-world priority is bounded by the significant precondition - attacker-controlled template content, which is not the default deployment for most consumers. Prioritize highly only where template bodies can be influenced by untrusted users. |
| Exploit ScenarioDerived | An attacker submits a crafted Velocity template string (for example via a form field, saved report template, or API parameter that a Node.js app later renders with velocityjs) containing |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 23, 2026
Prototype pollution in the velocityjs npm package (Velocity.js <= 2.1.5) lets an attacker who controls template content poison Object.prototype through the #set directive, enabling denial of service and, depending on server-side gadgets, remote code execution. The flaw stems from unvalidated path-key assignment in /src/compile/set.ts, which writes attacker-supplied keys directly onto the target object. Publicly available exploit code exists (a working PoC is published in the GHSA advisory); there is no evidence of active exploitation, and the EPSS score is very low at 0.08% (23rd percentile).
Earlier versions of this analysis (1)
Prototype pollution in Velocity.js npm package versions <=2.1.5 allows remote attackers to modify Object.prototype through malicious #set directives in templates, enabling denial of service or potential remote code execution when template content is attacker-controlled. Publicly available exploit code exists. EPSS data unavailable, but the low attack complexity (CVSS AC:L), network attack vector (AV:N), and no authentication requirement (PR:N) combined with published POC code indicate elevated risk for applications rendering untrusted Velocity templates.
RemediationAI
No vendor-released patch identified at time of analysis - the advisory records 'fixed in: None', so a version-based upgrade is not yet available; monitor GHSA-j658-c2gf-x6pq (https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-j658-c2gf-x6pq) and the upstream repo https://github.com/shepherdwind/velocity.js for a fixed release. As the primary compensating control, do not render Velocity templates whose content originates from or can be influenced by untrusted users; treat template bodies as code and pass user input only through the data context object rather than the template string. Where rendering of semi-trusted template input is unavoidable, sanitize or reject #set directives and block the literal keys __proto__, constructor, and prototype before rendering, accepting that this breaks any template legitimately using those names. As process-level hardening, run rendering with a frozen prototype (Object.freeze(Object.prototype)) so pollution attempts throw rather than mutate global state - note this can break libraries that rely on a writable prototype and must be tested. Isolating rendering in a separate process or worker limits the blast radius of a successful DoS/pollution.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Velocity.js is a pure-JavaScript reimplementation of the Apache Velocity templating engine, distributed as the npm package velocityjs (pkg:npm/velocityjs) and used to render server-side templates in Node.js applications. The vulnerability is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, i.e. prototype pollution). When the engine processes a #set directive, it resolves the assignment target and writes with the pattern (baseRef as Record<string, unknown>)[key] = val in set.ts without denylisting or filtering dangerous keys such as __proto__, constructor, or prototype. Because JavaScript property access on __proto__ traverses to the shared Object.prototype, a directive like #set($__proto__.polluted = "hacked") mutates the prototype inherited by every object in the process, corrupting global application state.
Know when Prototype Pollution gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N/PR:N since a remote unauthenticated attacker supplying template content triggers it, but AC:H because meaningful impact depends on attacker-controlled template surface and an environment gadget; guaranteed impact is integrity/DoS, so C:L.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Summary
A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.
Details
The root cause is located in the #set path assignment logic within the source code:
- File: /src/compile/set.ts
- Issue: The engine accepts arbitrary path keys and performs assignments using the logic
(baseRef as Record<string, unknown>)[key] = val.
Because there is no validation or filtering to block sensitive keys such as \_\_proto\_\_, constructor, or prototype, an attacker can traverse the prototype chain and pollute the global Object.prototype.
PoC
const {render} = require('velocityjs');
delete Object.prototype.polluted;
console.log({}.polluted); // ""
render('#set($__proto__.polluted = "hacked")', {});
console.log({}.polluted); // "hacked"
delete Object.prototype.polluted;Impact
- Vulnerability Type: Prototype Pollution
- Who is impacted: Any application that renders Velocity templates where the template content can be influenced or controlled by untrusted users.
- Severity: High. Prototype pollution can often be used to bypass security controls, cause application crashes (DoS), or be chained with other vulnerabilities to achieve code execution.
Executive ViewAI
The velocityjs npm package (Velocity.js ≤2.1.5) contains a critical prototype pollution vulnerability enabling remote code execution in applications that process untrusted templates. Although public exploit code is available, active exploitation likelihood remains minimal (EPSS 0.08%), but the absence of a vendor patch forces organizations to implement alternative mitigations immediately rather than applying a standard security update.
No vendor-released patch identified at time of analysis. Interim mitigations include: restricting all template processing to verified trusted sources (architectural control), implementing strict input validation and sanitization of all template inputs, isolating Velocity.js processes in containerized or sandboxed environments with minimal privilege, establishing real-time alerting on template compilation errors as exploitation signals, and conducting urgent evaluation of upgrade paths to the latest Velocity.js version or migration to actively maintained alternatives.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function. Rated critical severity (
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to co
This affects the package ini before 1.3.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
Exploit-DB