velocity.js vulnerabilities

2 known vulnerabilities in velocity.js from Shepherdwind. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  velocity.js: Improper Control of Generation of Code

  CVE-2026-73649Aug 13, 2026Shepherdwind

  Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read

• 9.8 Critical severity

  velocity.js: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2026-44966May 26, 2026Shepherdwind

  Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of #set directives in Velocity templates. If an a