https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 04:23:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-323534 EUVD-2026-323534 https://cve.radiocsirt.org/vuln/euvd-2026-323534 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44966 <p>Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.</p> <p>Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44966 https://cve.radiocsirt.org/vuln/ghsa-j658-c2gf-x6pq <p><strong>Affected:</strong> npm: velocityjs</p> <p>### Summary A prototype pollution vulnerability was discovered in Velocity.js &lt;= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.</p> <p>### Details The root cause is located in the #set path assignment logic within the source code: - File: /src/compile/set.ts - Issue: The engine accepts arbitrary path keys and performs assignments using the logic `(baseRef as Record&lt;string, unknown&gt;)[key] = val`.</p> <p>Because there is no validation or filtering to block sensitive keys such as \_\_proto\_\_, constructor, or prototype, an attacker can traverse the prototype chain and pollute the global Object.prototype.</p> <p>### PoC ```javascript const {render} = require(&#39;velocityjs&#39;); delete Object.prototype.polluted; console.log({}.polluted); // &#34;&#34; render(&#39;#set($__proto__.polluted = &#34;hacked&#34;)&#39;, {}); console.log({}.polluted); // &#34;hacked&#34; delete Object.prototype.polluted; ```</p> <p>### Impact - Vulnerability Type: Prototype Pollution - Who is impacted: Any application that renders Velocity templates where the template content can be influenced or controlled by untrusted users. - Severity: High. Prototype pollution can often be used to bypass security controls, cause application crashes (DoS), or be chained with other vulnerabilities to achieve code exe…</p> <p><strong>Affected:</strong> npm: velocityjs</p> <p>### Summary A prototype pollution vulnerability was discovered in Velocity.js &lt;= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.</p> <p>### Details The root cause is located in the #set path assignment logic within the source code: - File: /src/compile/set.ts - Issue: The engine accepts arbitrary path keys and performs assignments using the logic `(baseRef as Record&lt;string, unknown&gt;)[key] = val`.</p> <p>Because there is no validation or filtering to block sensitive keys such as \_\_proto\_\_, constructor, or prototype, an attacker can traverse the prototype chain and pollute the global Object.prototype.</p> <p>### PoC ```javascript const {render} = require(&#39;velocityjs&#39;); delete Object.prototype.polluted; console.log({}.polluted); // &#34;&#34; render(&#39;#set($__proto__.polluted = &#34;hacked&#34;)&#39;, {}); console.log({}.polluted); // &#34;hacked&#34; delete Object.prototype.polluted; ```</p> <p>### Impact - Vulnerability Type: Prototype Pollution - Who is impacted: Any application that renders Velocity templates where the template content can be influenced or controlled by untrusted users. - Severity: High. Prototype pollution can often be used to bypass security controls, cause application crashes (DoS), or be chained with other vulnerabilities to achieve code exe…</p> https://cve.radiocsirt.org/vuln/ghsa-j658-c2gf-x6pq