CVE-2026-44966: Velocity.js has a Prototype Pollution vulnerability through #set path assignment

May 9, 2026 (updated June 8, 2026)

A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.

References

github.com/advisories/GHSA-j658-c2gf-x6pq
github.com/shepherdwind/velocity.js/security/advisories/GHSA-j658-c2gf-x6pq
nvd.nist.gov/vuln/detail/CVE-2026-44966

Code Behaviors & Features

Detect and mitigate CVE-2026-44966 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →