EUVD-2026-58192
GHSA-7gfh-x38p-prh3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote code execution via attacker-controlled template with no user interaction yields AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; scope unchanged as code runs in the same server process.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Blast Radius
ecosystem impact- 117 npm packages depend on velocityjs (56 direct, 61 indirect)
Ecosystem-wide dependent count for version 2.1.7.
DescriptionCVE.org
Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts remained unfiltered. The getReferences() flow called getAttributes(), whose property access allowed an attacker-controlled template to traverse constructor.constructor to the JavaScript Function constructor. The #set handler validated only the assignment target and did not inspect the right-hand property-read expression, allowing arbitrary shell commands, environment-variable access, cloud-credential access, and internal-network access in the server process. This issue is fixed in version 2.1.7.
Articles & Coverage 2
AnalysisAI
Remote code execution in Velocity.js (npm 'velocityjs') versions <= 2.1.6 lets an attacker who controls template content reach the JavaScript Function constructor and run arbitrary code in the server process. The earlier CVE-2026-44966/GHSA-j658-c2gf-x6pq fix only filtered constructor/__proto__/prototype in the #set assignment target, leaving property-read expressions in references.ts unguarded, so this is a straightforward bypass. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The one hard prerequisite is that the target application must render attacker-controlled Velocity.js template source through velocityjs <= 2.1.6 (e.g., velocity.render() on untrusted input); given that, exploitation needs no authentication, no user interaction, and works against default library behavior (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than a paper-high CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An application exposes a feature that renders user-submitted Velocity templates (e.g., customizable email/notification templates or a reporting layout). An unauthenticated attacker submits a template like '#set($f=$x.constructor.constructor("return process.mainModule.require('child_process').execSync('whoami').toString()"))#set($r=$f())$r', which resolves to the Function constructor and executes a shell command in the server process. … |
| Remediation | Vendor-released patch: upgrade velocityjs to 2.1.7 or later (npm install velocityjs@^2.1.7 and rebuild/redeploy), which centralizes prototype-key filtering in src/compile/prototype-guard.ts and applies it to both #set targets and property-read expressions; see GHSA-7gfh-x38p-prh3, PR #192, and release v2.1.7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: scan production infrastructure to identify and inventory all deployments of velocityjs versions 2.1.6 or earlier, and immediately restrict processing of untrusted or user-supplied template input. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today