CVE-2026-44966: Velocity.js has a Prototype Pollution vulnerability through #set path assignment

May 9, 2026

A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.

References

github.com/advisories/GHSA-j658-c2gf-x6pq
github.com/shepherdwind/velocity.js
github.com/shepherdwind/velocity.js/security/advisories/GHSA-j658-c2gf-x6pq
nvd.nist.gov/vuln/detail/CVE-2026-44966

Code Behaviors & Features

Detect and mitigate CVE-2026-44966 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →