shepherdwind vulnerabilities

Products

• velocity.js 2

Latest shepherdwind CVEs

Newest publication first

1. CVE-2026-73649 Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix)

   Published 2026-08-13

   Critical·CVSS 9.8 EPSS 0.73%

   Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, proto, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read expressions in src/compi...

2. CVE-2026-44966 Velocity.js: Prototype Pollution in #set path assignment

   Published 2026-05-26

   Critical·CVSS 9.8 EPSS 0.55%

   Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.