@0xc/serverless-offline-aws-sqs (>=1.0.0, <=2.0.3), @claspo/common (>=5.2.1-theme.13, <=7.5.14) +166 more potentially affected by CVE-2026-73649 via velocityjs (>=0.3.7, <=2.1.6)

velocityjs NPM version =0.3.7, =1.0.0, =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =0.12.0, =0.0.6, =0.14.2, =1.4.0-1, =0.0.0, =1.0.0, =1.0.0, =0.0.1, =1.3.2, =1.4.3 and more Source cves: CVE-2026-73649 Source advisory: MEND:CVE-2026-73649...

📄 velocityjs 2.1.5 Prototype Pollution

A proof of concept exploit for velocityjs versions 0.3.1 through 2.1.5 that contain a prototype pollution vulnerability. The exploit abuses an unvalidated set left-hand path to write arbitrary properties into Object.prototype, enabling authorization bypasses and, on Node.js 16 and earlier,...

@claspo/common (>=5.2.1-theme.13, <=7.5.14), @claspo/components (>=1.1.14, <=1.10.30) +3 more potentially affected by CVE-2026-73649 via velocityjs (>=2.0.6, <=2.1.6)

velocityjs NPM version =2.0.6, =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.7.1 Source cves: CVE-2026-73649 Source advisory: OSV:GHSA-7GFH-X38P-PRH3...

GHSA-7GFH-X38P-PRH3 Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

Summary Remote Code Execution RCE in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq "Prototype Pollution in set path assignment" — that advisory blocked constructor/proto/prototype only in the set assignment handler set.cjs, but...

Arbitrary Code Injection

Overview velocityjs is a Velocity Template LanguageVTL for JavaScript Affected versions of this package are vulnerable to Arbitrary Code Injection via the getAttributes function. An attacker can execute arbitrary code on the server by crafting malicious Velocity templates that access the...

NPM: Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

NPM: Velocity.js: Remote Code Execution via property-read to Function constructor bypass of GHSA-j658-c2gf-x6pq fix vulnerability discovered by ? in WordPress Npm velocityjs versions = 2.1.6...

@claspo/common (>=5.2.1-theme.13, <=7.5.14), @claspo/components (>=1.1.14, <=1.10.30) +3 more potentially affected by unknown CVE via velocityjs (>=2.0.6, <=2.1.6)

velocityjs NPM version =2.0.6, =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.7.1 Source cves: unknown CVE Source advisory: SNYK:JS-VELOCITYJS-18319515...

@claspo/common (>=5.2.1-theme.13, <=7.5.14), @claspo/components (>=1.1.14, <=1.10.30) +3 more potentially affected by CVE-2026-73649 via velocityjs (>=2.0.6, <=2.1.6)

velocityjs NPM version =2.0.6, =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.7.1 Source cves: CVE-2026-73649 Source advisory: GHSA-7GFH-X38P-PRH3...

PT-2026-67474

Summary Remote Code Execution RCE in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq "Prototype Pollution in set path assignment" — that advisory blocked constructor/ proto /prototype only in the set assignment handler set.cjs, but...

ROOT-APP-NPM-GHSA-7GFH-X38P-PRH3 GHSA-7gfh-x38p-prh3 in @rootio/velocityjs - Patched by Root

Root has patched GHSA-7gfh-x38p-prh3 in the @rootio/velocityjs package for Root:npm. Multiple fixed versions available...

PT-2026-67375

Root has patched GHSA-7gfh-x38p-prh3 in the @rootio/velocityjs package for Root:npm. Multiple fixed versions available...

@0xc/serverless-offline-aws-sqs (>=1.0.0, <=2.0.3), @claspo/common (>=5.2.1-theme.13, <=7.4.0) +166 more potentially affected by CVE-2026-44966 via velocityjs (>=0.3.7, <=2.0.6)

velocityjs NPM version =0.3.7, =1.0.0, =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =0.12.0, =0.0.6, =0.14.2, =1.4.0-1, =0.0.0, =1.0.0, =1.0.0, =0.0.1, =1.3.2, =1.4.3 and more Source cves: CVE-2026-44966 Source advisory: MEND:CVE-2026-44966...

CVE-2026-44966

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of set directives in Velocity templates. If an application renders a template controll...

@claspo/common (>=5.2.1-theme.13, <=7.4.0), @claspo/components (>=1.1.14, <=1.10.12) +3 more potentially affected by CVE-2026-44966 via velocityjs (2.0.6)

velocityjs NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on velocityjs and may be impacted: - @claspo/common =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.4.1 Source cves: CVE-2026-44966 Source...

@claspo/common (>=5.2.1-theme.13, <=7.4.0), @claspo/components (>=1.1.14, <=1.10.12) +3 more potentially affected by CVE-2026-44966 via velocityjs (2.0.6)

velocityjs NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on velocityjs and may be impacted: - @claspo/common =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.4.1 Source cves: CVE-2026-44966 Source...

@claspo/common (>=5.2.1-theme.13, <=7.4.0), @claspo/components (>=1.1.14, <=1.10.12) +3 more potentially affected by CVE-2026-44966 via velocityjs (2.0.6)

velocityjs NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on velocityjs and may be impacted: - @claspo/common =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.4.1 Source cves: CVE-2026-44966 Source...