CVE-2026-73649
1 advisory.
npm/velocityjs CVE-2026-73649: critical 9.8, EPSS 0.73%
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
Action: Upgrade velocityjs to 2.1.7 or later.
npm i velocityjs@2.1.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.7 | - |
Fixed versions
| 2.1.7 |
Sources
- osv: GHSA-7gfh-x38p-prh3
- https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-7gfh-x38p-prh3
- https://github.com/shepherdwind/velocity.js/pull/192
- https://github.com/shepherdwind/velocity.js/commit/f8e47a6c4607249b9c967d3a1ced959b4dd64dba
- https://github.com/shepherdwind/velocity.js
- https://github.com/shepherdwind/velocity.js/releases/tag/v2.1.7
CVE-2026-73649 · published · modified · JSON