Cyber Resilience

CVE-2026-44966

HighPublic PoC

Published: 26 May 2026

Published
26 May 2026
Modified
02 June 2026
KEV Added
Patch
CVSS Score v3.1 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
EPSS Score 0.0050 39.4th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-44966 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Shepherdwind Velocity.Js. Its CVSS base score is 8.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

No EU or UK CSIRT advisories indexed for this CVE.

Vulnerability details

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a…

more

template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

Prototype pollution in template processing enables RCE when attacker-controlled templates are rendered in a web app (T1190); achieved via JavaScript execution (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-24292Shared CWE-1321
CVE-2024-38985Shared CWE-1321
CVE-2026-26021Shared CWE-1321
CVE-2026-25754Shared CWE-1321
CVE-2026-25881Shared CWE-1321
CVE-2024-12629Shared CWE-1321
CVE-2026-29063Shared CWE-1321
CVE-2026-24888Shared CWE-1321
CVE-2026-2964Shared CWE-1321
CVE-2026-6621Shared CWE-1321

Affected Assets

shepherdwind
velocity.js
≤ 2.1.5

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References