External risk intelligence

Velocity.js Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73649

Velocity.js is a template engine library embedded within applications. While it can be used to render public-facing web content, its exposure depends entirely on the specific application implementation and whether user-supplied templates are processed. It is not an edge service or standalone gateway by design.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Velocity.js, a JavaScript implementation of the Apache Velocity template engine. This issue could allow attackers to execute arbitrary commands, access sensitive data like cloud credentials, or gain network access within the server process if vulnerable applications process untrusted templates. The primary concern is to confirm if our systems utilize this specific technology and are potentially exposed.

Allows remote command and data access.
Matters if applications process untrusted templates.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by providing a specially crafted template to an application using a vulnerable version of Velocity.js. The template would manipulate property read expressions, bypassing security filters designed to prevent access to sensitive JavaScript object properties like `constructor`. This allows an attacker to reach the JavaScript `Function` constructor, which can then be used to execute arbitrary commands on the server.

No special access needed.
Malicious template input.
Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary commands, access environment variables, and potentially gain access to cloud credentials or internal network resources when a vulnerable version of Velocity.js processes user-controlled templates.

Server-side code and sensitive data.
Processing untrusted user templates.
Unauthorized access and command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Velocity.js JavaScript template engine's vulnerability necessitates action from application owners and platform teams. The first practical move is to identify all deployments of Velocity.js, confirm their reachability and business criticality, and then assign ownership for remediation.

Application owners should own this issue.
Verify Velocity.js usage and reachability.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Velocity.js and how is it used?

Velocity.js is a JavaScript-based implementation of the Apache Velocity template engine. Developers use it to dynamically generate text-based content, such as web pages or emails, by merging data into predefined templates. It functions as a library embedded within applications to handle server-side rendering logic.

What is the vulnerability in CVE-2026-73649?

This vulnerability is classified as CWE-94, or Improper Control of Generation of Code. It occurs because the library fails to restrict access to sensitive JavaScript object properties during template processing. By traversing these properties, an attacker can access the powerful Function constructor, enabling them to execute unauthorized shell commands or steal sensitive data within the application process.

How does an attacker trigger this CVE-2026-73649 vulnerability?

An attacker triggers the bug by providing a maliciously crafted template to an application that uses a vulnerable version of the library. It is important to note that the flaw is not triggered by standard template usage, but specifically when the application processes untrusted user-supplied input as a template. If an application only processes templates authored by trusted internal developers, the risk is significantly mitigated.

How does Halo Surface Signal determine if this is relevant?

Halo Surface Signal assesses relevance by looking at how the library is deployed. Because Velocity.js is an embedded library rather than an edge service, exposure depends on whether your specific application implementation allows users to input or manipulate templates. If an application is internet-facing and accepts user-controlled templates, Halo identifies it as a higher priority for review.

What should I do if my applications use Velocity.js?

First, identify all instances where your software stack includes Velocity.js. Once identified, evaluate whether those applications process untrusted user input within their templates, as this is the primary requirement for exploitation. Prioritize updating the library to version 2.1.7, which introduces the necessary filters to block unauthorized property access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.