CVE-2026-44966

描述

### Summary A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment. ### Details The root cause is located in the #set path assignment logic within the source code: - File: /src/compile/set.ts - Issue: The engine accepts arbitrary path keys and performs assignments using the logic `(baseRef as Record<string, unknown>)[key] = val`. Because there is no validation or filtering to block sensitive keys such as \_\_proto\_\_, constructor, or prototype, an attacker can traverse the prototype chain and pollute the global Object.prototype. ### PoC ```javascript const {render} = require('velocityjs'); delete Object.prototype.polluted; console.log({}.polluted); // "" render('#set($__proto__.polluted = "hacked")', {}); console.log({}.polluted); // "hacked" delete Object.prototype.polluted; ``` ### Impact - Vulnerability Type: Prototype Pollution - Who is impacted: Any application that renders Velocity templates where the template content can be influenced or controlled by untrusted users. - Severity: High. Prototype pollution can often be used to bypass security controls, cause application crashes (DoS), or be chained with other vulnerabilities to achieve code execution.

如何修補 CVE-2026-44966

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本

CVE-2026-44966 正在被利用嗎?

低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, <= 2.1.5

CVSS 分數