Yumarun

**Name of the Vulnerable Software and Affected Versions** Velocity.js versions prior to 2.1.6 **Description** A prototype pollution issue exists during the processing of #set directives in Velocity templates. This occurs because the engine accepts arbitrary path keys and performs assignments without validating or filtering sensitive keys such as ` proto `, `constructor`, or `prototype`. If an application renders a template controlled by an attacker, it is possible to modify `Object.prototype`, which can lead to a denial of service (DoS) or be chained to achieve remote code execution (RCE) depending on the server environment. Prototype pollution is a technique where an attacker manipulates the prototype of a base object to inject properties into all objects inheriting from that prototype. **Recommendations** Update to a version newer than 2.1.5. As a temporary workaround, restrict the ability of untrusted users to control or influence the content of Velocity templates. Avoid using the #set directive with user-supplied input until the software is updated.