GHSA-7gfh-x38p-prh3: Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
(updated )
Remote Code Execution (RCE) in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq (“Prototype Pollution in #set path assignment”) — that advisory blocked constructor/proto/prototype only in the #set assignment handler (set.cjs), but property read expressions are unfiltered. Any application rendering attacker-controlled Velocity templates is vulnerable to arbitrary code execution on the server.
References
- github.com/advisories/GHSA-7gfh-x38p-prh3
- github.com/shepherdwind/velocity.js/commit/f8e47a6c4607249b9c967d3a1ced959b4dd64dba
- github.com/shepherdwind/velocity.js/pull/192
- github.com/shepherdwind/velocity.js/releases/tag/v2.1.7
- github.com/shepherdwind/velocity.js/security/advisories/GHSA-7gfh-x38p-prh3
- nvd.nist.gov/vuln/detail/CVE-2026-73649
Code Behaviors & Features
Detect and mitigate GHSA-7gfh-x38p-prh3 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →