PT-2026-39322 · Unknown · Velocityjs

Yumarun · CVE-2026-44966 · Published 2026-05-09 · Updated 2026-05-27

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Velocity.js versions prior to 2.1.6

Description A prototype pollution issue exists during the processing of #set directives in templates. The engine accepts arbitrary path keys and performs assignments in the /src/compile/set.ts file using the logic (baseRef as Record<string, unknown>)[key] = val. Due to a lack of validation or filtering for sensitive keys such as proto, constructor, or prototype, an attacker can traverse the prototype chain and pollute the global Object.prototype. This can lead to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.

Recommendations Update to a version newer than 2.1.5.

Exploit

Fix

RCE

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-44966

GHSA-J658-C2GF-X6PQ

Affected Products

Velocityjs

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44966.json · Exploit
• https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-j658-c2gf-x6pq · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j658-c2gf-x6pq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44966 · Security Note
• https://github.com/shepherdwind/velocity.js · Note
• https://t.me/CVEtracker/55034 · Telegram Post
• https://twitter.com/UpwindMDR/status/2053336845803528368 · Twitter Post
• https://twitter.com/dailycve/status/2052953589169922366 · Twitter Post