Critical Velocity.js RCE Flaw Patched

Security researchers have identified a critical remote code execution (RCE) vulnerability in Velocity.js, tracked as GHSA-7gfh-x38p-prh3. The flaw affects version 2.1.6 and carries a CVSS score of 9.8, indicating the highest level of severity for systems utilizing this template engine.

What's at Risk

The vulnerability impacts all applications using npm/velocityjs version 2.1.6. Organizations that render attacker-controlled Velocity templates are at significant risk, as the flaw allows for arbitrary code execution on the underlying server. Any internet-facing service or internal application that processes user-supplied templates using this version of the library is potentially exposed.

How the Flaw Works

This vulnerability is a bypass of a previous security fix intended to prevent prototype pollution. In general, template injection vulnerabilities occur when user input is treated as code or evaluated by the underlying engine without sufficient sanitization. By navigating the object prototype chain—specifically targeting the Function constructor—an attacker can escape the intended sandbox environment. This class of weakness typically allows an attacker to manipulate server-side objects, ultimately leading to the execution of arbitrary system commands with the privileges of the application process.

How to Protect Your Systems

• Update to velocityjs version 2.1.7 or later immediately to patch the vulnerable property-read logic.
• Audit all application codebases that utilize Velocity.js to ensure the library has been updated across all environments.
• Restrict the ability for untrusted users to supply or modify templates processed by the application.
• Implement strict input validation and sanitization policies for all data passed into template engines.
• Monitor server logs for unusual process execution or unauthorized system calls originating from the application service account.

The discovery of this bypass highlights the necessity of comprehensive security testing that covers both assignment and evaluation phases of template rendering. Given the critical severity of this RCE and the ease with which it can be triggered, applying the patched version is the only effective way to neutralize the threat. Organizations should prioritize this update to prevent potential system compromise.