What is the CVSS score of CVE-2026-73649?

CVE-2026-73649 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Velocity.js are affected by CVE-2026-73649?

Velocity.js (npm package 'velocityjs') versions 2.1.6 and earlier contain a critical remote code execution vulnerability allowing attackers to execute arbitrary code through malicious template…. A patch is available.

Is there a public PoC exploit available for CVE-2026-73649?

Yes, a public proof-of-concept exploit is available for CVE-2026-73649. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-73649?

Within 24 hours: scan production infrastructure to identify and inventory all deployments of velocityjs versions 2.1.6 or earlier, and immediately restrict processing of untrusted or user-supplied template input. Within 7 days: verify patch timeline with Velocity.js maintainers and implement temporary access controls limiting template authorship to internal trusted teams; segregate affected systems into restricted network zones. Within 30 days: upgrade to a patched version once released, or migrate to an alternative template engine that provides stronger sandboxing and disables access to language constructors.

Velocity.js CVE-2026-73649

EUVD-2026-58192 CRITICAL

Code Injection (CWE-94)

2026-08-13 security-advisories@github.com

GHSA-7gfh-x38p-prh3

RCE Apache Code Injection

9.8

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote code execution via attacker-controlled template with no user interaction yields AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; scope unchanged as code runs in the same server process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 13, 2026 - 19:04 EUVD

Source Code Evidence Fetched

Aug 13, 2026 - 18:34 vuln.today

Analysis Generated

Aug 13, 2026 - 18:34 vuln.today

CVE Published

Aug 13, 2026 - 18:18 cve.org

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

117 npm packages depend on velocityjs (57 direct, 60 indirect)

Ecosystem-wide dependent count for version 2.1.7.

DescriptionCVE.org

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts remained unfiltered. The getReferences() flow called getAttributes(), whose property access allowed an attacker-controlled template to traverse constructor.constructor to the JavaScript Function constructor. The #set handler validated only the assignment target and did not inspect the right-hand property-read expression, allowing arbitrary shell commands, environment-variable access, cloud-credential access, and internal-network access in the server process. This issue is fixed in version 2.1.7.

Articles & Coverage 2

News 3 New Apache Vulnerabilities - 1 Critical, 2 High, 1 With POC Aug 14, 2026 News Critical RCE in Apache Velocity.js (velocityjs) <= 2.1.6 - CVE-2026-73649 Aug 13, 2026

AnalysisAI

Remote code execution in Velocity.js (npm 'velocityjs') versions <= 2.1.6 lets an attacker who controls template content reach the JavaScript Function constructor and run arbitrary code in the server process. The earlier CVE-2026-44966/GHSA-j658-c2gf-x6pq fix only filtered constructor/__proto__/prototype in the #set assignment target, leaving property-read expressions in references.ts unguarded, so this is a straightforward bypass. Publicly available exploit code exists (a working PoC is published in the GHSA advisory and was vendor-verified on v2.1.6); no confirmed active exploitation (not in CISA KEV).

Technical ContextAI

Velocity.js is a pure-JavaScript reimplementation of the Apache Velocity template engine, commonly embedded in Node.js applications to render VTL templates. The root cause is a classic CWE-94 Code Injection through JavaScript prototype-chain traversal: the getReferences() evaluation path calls getAttributes(), which performs raw property access (baseRef[property.id]) with no key filtering. An attacker-supplied reference such as $x.constructor.constructor walks {} → Object → Function, obtaining the Function constructor, which compiles and executes an arbitrary string as code. Per the CPE/package data the affected component is npm 'velocityjs' <= 2.1.6; the fix in 2.1.7 centralizes filtering in a new src/compile/prototype-guard.ts module (isBlockedPrototypeKey/hasBlockedUnknownPrototypePath) that both set.ts and references.ts now invoke, blocking __proto__ everywhere, prototype on function objects, and constructor/prototype traversal that would fall through to inherited prototype-chain properties.

RemediationAI

Vendor-released patch: upgrade velocityjs to 2.1.7 or later (npm install velocityjs@^2.1.7 and rebuild/redeploy), which centralizes prototype-key filtering in src/compile/prototype-guard.ts and applies it to both #set targets and property-read expressions; see GHSA-7gfh-x38p-prh3, PR #192, and release v2.1.7. If you cannot upgrade immediately, the highest-value compensating control is to stop rendering attacker-controlled template source entirely - treat templates as trusted code and never build them from user input (side effect: removes any user-templating feature). Where user templating must remain, sandbox rendering in a separate least-privilege worker/process or container with no filesystem, network egress, or cloud-credential access (side effect: added deployment complexity and latency), and/or pre-filter template input to reject references containing 'constructor', '__proto__', or 'prototype' (side effect: fragile blocklisting that can be bypassed and may break legitimate templates). These are stopgaps; upgrading to 2.1.7 is the reliable fix.