Velocity.Js

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:shepherdwind:velocity.js:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorShepherdwind (27e6fd3b-22a8-569b-9d14-660b25a61143)
ProductVelocity.Js (6300733c-1fbd-5b67-ba20-44b4e0825296)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
pkg:github/shepherdwind/velocity.js purl2cpe 2026-06-19 13:12:45.114916
pkg:npm/velocityjs purl2cpe 2026-06-19 13:12:45.114919

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-44966 vulnerable 2026-06-08 08:05:11.390949 Velocity.js: Prototype Pollution in #set path assignment
HIGH (8.3)
Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.
Published: 2026-05-26T21:21:29.986Z
Updated: 2026-06-01T17:08:58.934Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.