{"id":"CVE-2026-73649","sourceIdentifier":"security-advisories@github.com","published":"2026-08-13T18:18:20.793","lastModified":"2026-10-24T15:10:00.190","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts remained unfiltered. The getReferences() flow called getAttributes(), whose property access allowed an attacker-controlled template to traverse constructor.constructor to the JavaScript Function constructor. The #set handler validated only the assignment target and did not inspect the right-hand property-read expression, allowing arbitrary shell commands, environment-variable access, cloud-credential access, and internal-network access in the server process. This issue is fixed in version 2.1.7."},{"lang":"es","value":"Velocity.js es una implementación de JavaScript del motor de plantillas Apache Velocity. Antes de la versión 2.1.7, la corrección anterior para CVE-2026-44966 filtraba constructor, __proto__ y prototype solo en el gestor de asignación #set en src/compile/set.ts, mientras que las expresiones de lectura de propiedades en src/compile/references.ts permanecían sin filtrar. El flujo de getReferences() llamaba a getAttributes(), cuyo acceso a propiedades permitía que una plantilla controlada por el atacante atravesara constructor.constructor hasta el constructor de funciones de JavaScript. El gestor #set validaba solo el objetivo de la asignación y no inspeccionaba la expresión de lectura de propiedades del lado derecho, permitiendo comandos de shell arbitrarios, acceso a variables de entorno, acceso a credenciales de la nube y acceso a la red interna en el proceso del servidor. Este problema está corregido en la versión 2.1.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"shepherdwind","product":"velocity.js","versions":[{"version":"< 2.1.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-14T16:42:05.530314Z","id":"CVE-2026-73649","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/shepherdwind/velocity.js/commit/f8e47a6c4607249b9c967d3a1ced959b4dd64dba","source":"security-advisories@github.com"},{"url":"https://github.com/shepherdwind/velocity.js/pull/192","source":"security-advisories@github.com"},{"url":"https://github.com/shepherdwind/velocity.js/releases/tag/v2.1.7","source":"security-advisories@github.com"},{"url":"https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-7gfh-x38p-prh3","source":"security-advisories@github.com"},{"url":"https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-7gfh-x38p-prh3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}