CVE-2026-44966

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-j658-c2gf-x6pq	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:shepherdwind:velocity.js:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2026-05-26 22:16

Updated : 2026-07-24 12:10

NVD link : CVE-2026-44966

Mitre link : CVE-2026-44966

CVE.ORG link : CVE-2026-44966

JSON object : View

Products Affected

shepherdwind

velocity.js

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2026-44966", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44966", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T17:04:32.448870Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "shepherdwind", "product": "velocity.js", "versions": [{"status": "affected", "version": "<= 2.1.5"}]}]}], "published": "2026-05-26T22:16:43.293", "references": [{"url": "https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-j658-c2gf-x6pq", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment."}, {"lang": "es", "value": "Velocity.js es una implementaci\u00f3n JavaScript del motor de plantillas Apache Velocity. En 2.1.5 y versiones anteriores, se descubri\u00f3 una vulnerabilidad de contaminaci\u00f3n de prototipos en velocityjs. Este problema ocurre durante el procesamiento de las directivas #set en las plantillas Velocity. Si una aplicaci\u00f3n renderiza una plantilla controlada por un atacante, es posible modificar Object.prototype, lo que podr\u00eda llevar a una denegaci\u00f3n de servicio (DoS) o a una ejecuci\u00f3n remota de c\u00f3digo (RCE) dependiendo del entorno del servidor."}], "lastModified": "2026-07-24T12:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:shepherdwind:velocity.js:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "83F47F23-C6EA-4E90-A77B-D37B77D8C344", "versionEndIncluding": "2.1.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}