Velocity.js has a Prototype Pollution vulnerability through #set path assignment
Date: 2026-05
Affected: npm/velocityjs
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-44966
CWE: CWE-1321
CVSS: 8.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L)

### Summary A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment. ### Details The root cause is located in the #set path assignment logic within the source code: - File: /src/compile/set.ts - Issue: The engine accepts arbitrary path keys and performs assignments using the logic `(baseRef as Record<string, unknown>)[key] = val`. Because there is no validation or filtering to block sensitive keys such as \_\_proto\_\_, constructor, or prototype, an attacker can traverse the prototype chain and pollute the global Object.prototype. ### PoC ```javascript const {render} = require('velocityjs'); delete Object.prototype.polluted; console.log({}.polluted); // "" render('#set($__proto__.polluted = "hacked")', {}); console.log({}.polluted); // "hacked" delete Object.prototype.polluted; ``` ### Impact - Vulnerability Type: Prototype Pollution - Who is impacted: Any application that renders Velocity templates where the template content can be influenced or controlled by untrusted users. - Severity: High. Prototype pollution can often be used to bypass security controls, cause application crashes (DoS), or be chained with other vulnerabilities to achieve code exec


Mitigations:

Architectural layers (MAESTRO):