Description
A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 2.1.5
References
Could your website be exposed too?
SmartScanner can check your website for Velocity.js has a Prototype Pollution vulnerability through #set path assignment and gives you actionable findings to investigate.
Start a free scanRelated Issues
- dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() - CVE-2026-27837
- @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
- LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190
- @ranfdev/deepobj has a Prototype Pollution vulnerability - CVE-2026-46509
You might also like:
See something that needs correcting? Let us knowUpdated June 08, 2026