Description

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts remained unfiltered. The getReferences() flow called getAttributes(), whose property access allowed an attacker-controlled template to traverse constructor.constructor to the JavaScript Function constructor. The #set handler validated only the assignment target and did not inspect the right-hand property-read expression, allowing arbitrary shell commands, environment-variable access, cloud-credential access, and internal-network access in the server process. This issue is fixed in version 2.1.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T18:18:20.793Z",
  "pubdate": "2026-08-13T18:18:20.793Z",
  "executiveSummary": "Velocity.js, a JavaScript implementation of the Apache Velocity template engine prior to version 2.1.7, suffers from a critical remote code execution vulnerability stemming from incomplete prototype pollution and property filtering fixes associated with CVE-2026-44966. The vulnerability allows an attacker providing a crafted, attacker-controlled template to traverse prototype chains via property-read expressions to reach the underlying JavaScript Function constructor. Successful exploitation grants the ability to execute arbitrary shell commands, access environment variables, exfiltrate cloud credentials, and interact with internal network resources within the context of the server process. The risk implications are severe, potentially leading to complete system compromise. The vulnerability can be exploited by unauthenticated users capable of supplying or rendering untrusted templates, requiring no prior privileges other than the ability to pass malicious input to the parsing engine.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient mitigation for CVE-2026-44966. In affected versions prior to 2.1.7, the previous security patch filtered constructor, __proto__, and prototype strictly within the #set assignment handler located in src/compile/set.ts. However, property-read expressions handled in src/compile/references.ts remained entirely unfiltered. Consequently, the getReferences() execution flow invokes getAttributes(), where unchecked property access permits an attacker-controlled template to traverse constructor.constructor and ultimately access the native JavaScript Function constructor. Furthermore, the #set directive handler validates solely the left-hand assignment target while failing to inspect the right-hand property-read expression, leaving a critical bypass vector open.\nThe step-by-step attack flow begins when an application processes a malicious template supplied by an attacker. The template contains crafted property-read expressions designed to exploit the unchecked attribute resolution in src/compile/references.ts. By chaining property accesses such as constructor.constructor, the template escapes the intended sandboxed object scope and acquires a reference to the global Function constructor. Because input validation is bypassed during right-hand expression evaluation, the attacker can synthesize arbitrary JavaScript functions dynamically. When evaluated by the server process, the payload executes within the security context of the Node.js or JavaScript runtime hosting Velocity.js.\nThe vulnerable components include the reference compilation logic in src/compile/references.ts and the assignment handler in src/compile/set.ts within Velocity.js versions prior to 2.1.7. Exploitation requires network exposure where an untrusted template can be submitted to the application, but does not require authentication or prior privileges. The post-exploitation impact is catastrophic, enabling arbitrary shell command execution, unauthorized extraction of sensitive environment variables, compromise of cloud metadata and credentials, and lateral movement against internal network services."
}