PT-2026-39322 · Unknown · Velocityjs

Published 2026-05-09 · Updated 2026-05-09 · CVE-2026-44966

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Velocity.js versions prior to 2.1.6

Description A prototype pollution issue exists during the processing of #set directives in templates. The engine accepts arbitrary path keys and performs assignments in the /src/compile/set.ts file using the logic (baseRef as Record<string, unknown>)[key] = val. Due to a lack of validation or filtering for sensitive keys such as proto, constructor, or prototype, an attacker can traverse the prototype chain and pollute the global Object.prototype. This can lead to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.

Recommendations Update to a version newer than 2.1.5.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-44966

GHSA-J658-C2GF-X6PQ

Affected Products

Velocityjs

References · 3

• https://osv.dev/vulnerability/GHSA-j658-c2gf-x6pq · Vendor Advisory
• https://github.com/shepherdwind/velocity.js · Note
• https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-j658-c2gf-x6pq · Note