CVE-2026-73649
Received Received - Intake

Prototype Pollution in Velocity.js via Property-Read Expressions

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts remained unfiltered. The getReferences() flow called getAttributes(), whose property access allowed an attacker-controlled template to traverse constructor.constructor to the JavaScript Function constructor. The #set handler validated only the assignment target and did not inspect the right-hand property-read expression, allowing arbitrary shell commands, environment-variable access, cloud-credential access, and internal-network access in the server process. This issue is fixed in version 2.1.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73649
EUVD
EUVD-2026-58192

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
shepherdwind velocity.js 2.1.7
velocity velocity 2.1.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Remote Code Execution (RCE) vulnerability in Velocity.js versions 2.1.6 and earlier. It stems from an incomplete fix for a previous prototype pollution issue. Attackers can bypass existing protections by using property-read operations to access the JavaScript Function constructor, enabling arbitrary code execution on the server. The exploit involves traversing the prototype chain to construct malicious functions.

Detection Guidance

Detecting this vulnerability requires checking if your Velocity.js version is below 2.1.7. Use commands like 'npm list velocity' or 'grep "velocity" package.json' in your project directory to verify the installed version. If using a CDN, inspect the loaded script version in browser developer tools.

Impact Analysis

If you use Velocity.js versions 2.1.6 or earlier, an attacker could execute arbitrary shell commands, access environment variables, steal cloud credentials, or pivot to internal networks by rendering malicious templates. This could lead to full server compromise, data theft, or unauthorized system access.

Compliance Impact

This vulnerability could lead to severe compliance violations. Unauthorized code execution may result in data breaches, exposing sensitive personal or health information. GDPR requires protecting personal data, while HIPAA mandates safeguarding health information. A successful exploit could lead to regulatory fines, legal liabilities, and reputational damage.

Mitigation Strategies

Immediately upgrade Velocity.js to version 2.1.7 or later. If upgrading is not possible, review and sanitize all template inputs to prevent attacker-controlled data from reaching the template engine. Disable dynamic template execution if unused.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart