Velocity.js has a Prototype Pollution vulnerability through #set path assignment

Description

A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.1.5

References

• GHSA-j658-c2gf-x6pq
• CVE-2026-44966
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() - CVE-2026-27837
• @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
• LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190
• @ranfdev/deepobj has a Prototype Pollution vulnerability - CVE-2026-46509

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

Tags:

npm

velocityjs