CVE-2026-73649

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, proto, and prototype only in the set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts...

CVE-2026-73649

Velocity.js (Java) details: In versions prior to 2.1.7, an existing fix for CVE-2026-44966 protected only the #set assignment target, while property-read expressions in src/compile/references.ts were not filtered. The getReferences() flow could reach getAttributes() and allow a crafted template t...

@0xc/serverless-offline-aws-sqs (>=1.0.0, <=2.0.3), @claspo/common (>=5.2.1-theme.13, <=7.5.16) +166 more potentially affected by CVE-2026-73649 via velocityjs (>=0.3.7, <=2.1.6)

velocityjs NPM version =0.3.7, =1.0.0, =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =0.12.0, =0.0.6, =0.14.2, =1.4.0-1, =0.0.0, =1.0.0, =1.0.0, =0.0.1, =1.3.2, =1.4.3 and more Source cves: CVE-2026-73649 Source advisory: MEND:CVE-2026-73649...

@claspo/common (>=5.2.1-theme.13, <=7.5.16), @claspo/components (>=1.1.14, <=1.10.32) +3 more potentially affected by CVE-2026-73649 via velocityjs (>=2.0.6, <=2.1.6)

velocityjs NPM version =2.0.6, =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.8.0-bbp1 Source cves: CVE-2026-73649 Source advisory: OSV:GHSA-7GFH-X38P-PRH3...

@claspo/common (>=5.2.1-theme.13, <=7.5.16), @claspo/components (>=1.1.14, <=1.10.32) +3 more potentially affected by CVE-2026-73649 via velocityjs (>=2.0.6, <=2.1.6)

velocityjs NPM version =2.0.6, =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.8.0-bbp1 Source cves: CVE-2026-73649 Source advisory: GHSA-7GFH-X38P-PRH3...