CVE-2026-73649

Name of the Vulnerable Software and Affected Versions Velocity.js versions prior to 2.1.7

Description An issue exists where property-read expressions in src/compile/references.ts remain unfiltered, despite previous fixes for the #set assignment handler. The getReferences() flow calls getAttributes(), which allows property access that enables an attacker-controlled template to traverse constructor.constructor to reach the JavaScript Function constructor. Because the #set handler only validates the assignment target and not the right-hand property-read expression, an attacker can execute arbitrary shell commands, access environment variables, retrieve cloud credentials, and access the internal network within the server process.

Recommendations Update to version 2.1.7.