Critical, CVSS 9.8npmAmendedPublished
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
CVE-2026-73649 · GHSA-7gfh-x38p-prh3
- Affected
- npm velocityjs <= 2.1.6
- Fixed in
- 2.1.7· Vendor fix available
- Issue
- Remote Code Execution (RCE) in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq ("Prototype Pollution in #set path assignment") — that advisory blocked constructor/proto/prototype only in the #set assignment handler (set.cjs), but property read expressions are unfiltered. Any application rendering attacker-controlled Velocity templates is vulnerable to arbitrary code execution on the server. Details GHSA-j658-c2gf-x6pq added isBlockedPathKey() to dist/cjs/compile/set.cjs:35-43, which blocks proto, constructor, and prototype keys. However, this check only runs when the #set directive assigns a value — it validates the assignment target path, not the value expression being evaluated. The value expression is evaluated via getReferences() in dist/cjs/compile/references.cjs:16, which calls getAttributes() at line 81. The property access at line 88-89 has no filtering: // references.cjs:81-91 getAttributes(property,…
Recommended action: Upgrade to 2.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.