CVE-2026-44966 — Velocity.js: Prototype Pollution in #set path assignment

CVE-2026-44966

Velocity.js: Prototype Pollution in #set path assignment PUBLISHED

Description (CNA)

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.

Affected (CNA)

Vendor / product	Versions
shepherdwind / velocity.js	affected <= 2.1.5

CWE

CWE-1321

References

https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-j658-c2gf-x6pq

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.