{"action":"Upgrade velocityjs to 2.1.7 or later.","affected":[{"fixed":"2.1.7","introduced":"0"}],"component":"velocityjs","cve_ids":["CVE-2026-73649"],"ecosystem":"npm","epss":0.00726,"exploited":false,"fixed_versions":["2.1.7"],"ghsa_id":"GHSA-7gfh-x38p-prh3","id":"tcs_01M5KF9ZAFEX059YAQH6DQ21E7","modified_at":"2026-08-13T18:51:15.840308Z","published_at":"2026-07-24T16:21:22Z","references":["https://osv.dev/vulnerability/GHSA-7gfh-x38p-prh3","https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-7gfh-x38p-prh3","https://github.com/shepherdwind/velocity.js/pull/192","https://github.com/shepherdwind/velocity.js/commit/f8e47a6c4607249b9c967d3a1ced959b4dd64dba","https://github.com/shepherdwind/velocity.js","https://github.com/shepherdwind/velocity.js/releases/tag/v2.1.7"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-7gfh-x38p-prh3","url":"https://osv.dev/vulnerability/GHSA-7gfh-x38p-prh3"}],"summary":"Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)"}