Velocity.js CVE-2026-44966
CRITICAL
GHSA-j658-c2gf-x6pq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N/PR:N since a remote unauthenticated attacker supplying template content triggers it, but AC:H because meaningful impact depends on attacker-controlled template surface and an environment gadget; guaranteed impact is integrity/DoS, so C:L.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Summary
A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.
Details
The root cause is located in the #set path assignment logic within the source code:
- File: /src/compile/set.ts
- Issue: The engine accepts arbitrary path keys and performs assignments using the logic
(baseRef as Record<string, unknown>)[key] = val.
Because there is no validation or filtering to block sensitive keys such as \_\_proto\_\_, constructor, or prototype, an attacker can traverse the prototype chain and pollute the global Object.prototype.
PoC
const {render} = require('velocityjs');
delete Object.prototype.polluted;
console.log({}.polluted); // ""
render('#set($__proto__.polluted = "hacked")', {});
console.log({}.polluted); // "hacked"
delete Object.prototype.polluted;Impact
- Vulnerability Type: Prototype Pollution
- Who is impacted: Any application that renders Velocity templates where the template content can be influenced or controlled by untrusted users.
- Severity: High. Prototype pollution can often be used to bypass security controls, cause application crashes (DoS), or be chained with other vulnerabilities to achieve code execution.
AnalysisAI
Prototype pollution in the velocityjs npm package (Velocity.js <= 2.1.5) lets an attacker who controls template content poison Object.prototype through the #set directive, enabling denial of service and, depending on server-side gadgets, remote code execution. The flaw stems from unvalidated path-key assignment in /src/compile/set.ts, which writes attacker-supplied keys directly onto the target object. Publicly available exploit code exists (a working PoC is published in the GHSA advisory); there is no evidence of active exploitation, and the EPSS score is very low at 0.08% (23rd percentile).
Technical ContextAI
Velocity.js is a pure-JavaScript reimplementation of the Apache Velocity templating engine, distributed as the npm package velocityjs (pkg:npm/velocityjs) and used to render server-side templates in Node.js applications. The vulnerability is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, i.e. prototype pollution). When the engine processes a #set directive, it resolves the assignment target and writes with the pattern (baseRef as Record<string, unknown>)[key] = val in set.ts without denylisting or filtering dangerous keys such as __proto__, constructor, or prototype. Because JavaScript property access on __proto__ traverses to the shared Object.prototype, a directive like #set($__proto__.polluted = "hacked") mutates the prototype inherited by every object in the process, corrupting global application state.
RemediationAI
No vendor-released patch identified at time of analysis - the advisory records 'fixed in: None', so a version-based upgrade is not yet available; monitor GHSA-j658-c2gf-x6pq (https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-j658-c2gf-x6pq) and the upstream repo https://github.com/shepherdwind/velocity.js for a fixed release. As the primary compensating control, do not render Velocity templates whose content originates from or can be influenced by untrusted users; treat template bodies as code and pass user input only through the data context object rather than the template string. Where rendering of semi-trusted template input is unavoidable, sanitize or reject #set directives and block the literal keys __proto__, constructor, and prototype before rendering, accepting that this breaks any template legitimately using those names. As process-level hardening, run rendering with a frozen prototype (Object.freeze(Object.prototype)) so pollution attempts throw rather than mutate global state - note this can break libraries that rely on a writable prototype and must be tested. Isolating rendering in a separate process or worker limits the blast radius of a successful DoS/pollution.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today