Vendor
Shepherdwind
Products
1
CVEs
1
Across products
1
Status
Private
Products
1- 1 CVE
Recent CVEs
1| CVE | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-44966 | hig | 0.45 | — | — | May 9, 2026 | ### Summary A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment. ### Details The root cause is located in the #set path assignment logic within the source code: - File: /src/compile/set.ts - Issue: The engine accepts arbitrary path keys and performs assignments using the logic `(baseRef as Record<string, unknown>)[key] = val`. Because there is no validation or filtering to block sensitive keys such as \_\_proto\_\_, constructor, or prototype, an attacker can traverse the prototype chain and pollute the global Object.prototype. ### PoC ```javascript const {render} = require('velocityjs'); delete Object.prototype.polluted; console.log({}.polluted); // "" render('#set($__proto__.polluted = "hacked")', {}); console.log({}.polluted); // "hacked" delete Object.prototype.polluted; ``` ### Impact - Vulnerability Type: Prototype Pollution - Who is impacted: Any application that renders Velocity templates where the template content can be influenced or controlled by untrusted users. - Severity: High. Prototype pollution can often be used to bypass security controls, cause application crashes (DoS), or be chained with other vulnerabilities to achieve code execution. |