GHSA-7gfh-x38p-prh3: Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
(updated )
Remote Code Execution (RCE) in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq (“Prototype Pollution in #set path assignment”) — that advisory blocked constructor/proto/prototype only in the #set assignment handler (set.cjs), but property read expressions are unfiltered. Any application rendering attacker-controlled Velocity templates is vulnerable to arbitrary code execution on the server.
References
- github.com/advisories/GHSA-7gfh-x38p-prh3
- github.com/shepherdwind/velocity.js/commit/f8e47a6c4607249b9c967d3a1ced959b4dd64dba
- github.com/shepherdwind/velocity.js/pull/192
- github.com/shepherdwind/velocity.js/releases/tag/v2.1.7
- github.com/shepherdwind/velocity.js/security/advisories/GHSA-7gfh-x38p-prh3
- nvd.nist.gov/vuln/detail/CVE-2026-73649
Code Behaviors & Features
Detect and mitigate GHSA-7gfh-x38p-prh3 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →