What’s Vulnerable › Vulnerabilities
CVE-2026-44966: Velocity.js: Prototype Pollution in #set path assignment
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-05-26 · updated 2026-07-24
- Weakness: CWE-1321
Description
Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.
Affected products
- shepherdwind velocity.js: through 2.1.5
References
Get alerted when CVE-2026-44966 or the next vulnerability affects your stack