CVE-2026-44966

Name of the Vulnerable Software and Affected Versions Velocity.js versions prior to 2.1.6

Description A prototype pollution issue exists during the processing of #set directives in Velocity templates. This occurs because the engine accepts arbitrary path keys and performs assignments without validating or filtering sensitive keys such as proto, constructor, or prototype. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, which can lead to a denial of service (DoS) or be chained to achieve remote code execution (RCE) depending on the server environment. Prototype pollution is a technique where an attacker manipulates the prototype of a base object to inject properties into all objects inheriting from that prototype.

Recommendations Update to a version newer than 2.1.5. As a temporary workaround, restrict the ability of untrusted users to control or influence the content of Velocity templates. Avoid using the #set directive with user-supplied input until the software is updated.