GHSA-7GFH-X38P-PRH3 Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

Summary Remote Code Execution RCE in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq "Prototype Pollution in set path assignment" — that advisory blocked constructor/proto/prototype only in the set assignment handler set.cjs, but...

@claspo/common (>=5.2.1 <=7.3.0-rc1), @claspo/components (>=1.1.14 <=1.10.2) +3 more potentially affected by CVE-2026-44966 via velocityjs (=2.0.6)

velocityjs NPM version =2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on velocityjs and may be impacted: - @claspo/common =5.2.1, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1, =16.3.6 Source cves: CVE-2026-44966 Source advisory:...

@0xc/serverless-offline-aws-sqs (>=1.0.0 <=2.0.3), @claspo/common (>=5.2.1 <=7.3.0-rc1) +166 more potentially affected by CVE-2026-44966 via velocityjs (>=0.10.1 <=2.0.6)

velocityjs NPM version =0.10.1, =1.0.0, =5.2.1, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1, =0.12.0, =0.0.6, =0.14.2, =1.4.0, =0.0.0, =1.0.0, =1.0.0, =0.0.1, =1.3.2, =1.4.3 and more Source cves: CVE-2026-44966 Source advisory: OSV:GHSA-J658-C2GF-X6PQ...