Velocity.js Remote Code Execution via Function constructor bypass

Executive brief

Velocity.js is a library used to render templates in web applications. A vulnerability exists where an attacker can provide a specially crafted template that executes malicious code on the server. This could lead to a full system compromise, allowing attackers to steal sensitive data, access cloud credentials, or disrupt operations.

Technical details

A Remote Code Execution (RCE) vulnerability exists in velocityjs v2.1.6 due to an incomplete fix for a previous prototype pollution issue (GHSA-j658-c2gf-x6pq). While the previous fix blocked sensitive keys like 'constructor' and 'prototype' during variable assignment (#set), it failed to filter these keys during property read expressions in 'references.cjs'. An attacker can exploit this by using a template that traverses the prototype chain (e.g., via $x.constructor.constructor) to access the Function constructor and execute arbitrary JavaScript. This can be achieved without authentication if the application renders user-provided templates. The issue is resolved in version 2.1.7.

Affected products

• shepherdwind velocityjs <= 2.1.6

Timeline

• 2026-07-19: disclosed
• 2026-07-24: advisory: GitHub Advisory published
• 2026-07-24: patched: Fixed in version 2.1.7

References

• https://api.github.com/users/cruzryan
• https://github.com/cruzryan
• https://api.github.com/users/cruzryan/gists%7B/gist_id%7D
• https://api.github.com/users/cruzryan/repos
• https://avatars.githubusercontent.com/u/32502734?v=4
• https://api.github.com/users/cruzryan/events%7B/privacy%7D