{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/velocityjs--2.1.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["velocityjs \u003c= 2.1.6"],"_cs_severities":["critical"],"_cs_tags":["velocityjs","rce","nodejs","vulnerability","server-side"],"_cs_type":"advisory","_cs_vendors":["shepherdwind"],"content_html":"\u003cp\u003eA critical Remote Code Execution (RCE) vulnerability (GHSA-7gfh-x38p-prh3) has been identified in \u003ccode\u003evelocityjs\u003c/code\u003e versions up to 2.1.6, impacting applications that render attacker-controlled Velocity templates. This flaw represents a bypass of the previously issued fix for GHSA-j658-c2gf-x6pq, which addressed prototype pollution but incompletely mitigated the underlying issue. The vulnerability allows an attacker to manipulate unfiltered property-read expressions to invoke the JavaScript \u003ccode\u003eFunction\u003c/code\u003e constructor with arbitrary code. This can lead to the execution of arbitrary shell commands on the server, enabling full system compromise, data exfiltration, and lateral movement. This exploit is particularly dangerous because it stems from a fix that was incomplete, leaving a critical attack vector open.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts and submits a malicious Velocity template containing an RCE payload to a vulnerable application.\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003evelocityjs\u003c/code\u003e template engine begins processing the malicious template, specifically evaluating the expression \u003ccode\u003e$x.constructor.constructor(...)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDuring template evaluation, the \u003ccode\u003egetAttributes()\u003c/code\u003e function in \u003ccode\u003ereferences.cjs\u003c/code\u003e is called for \u003ccode\u003e$x.constructor\u003c/code\u003e, which, due to a lack of filtering, resolves to the \u003ccode\u003eObject\u003c/code\u003e constructor.\u003c/li\u003e\n\u003cli\u003eSubsequently, the second \u003ccode\u003e.constructor\u003c/code\u003e lookup on the \u003ccode\u003eObject\u003c/code\u003e constructor is processed, also via \u003ccode\u003egetAttributes()\u003c/code\u003e, resolving to the JavaScript \u003ccode\u003eFunction\u003c/code\u003e constructor.\u003c/li\u003e\n\u003cli\u003eThe attacker's arbitrary JavaScript string payload, such as \u003ccode\u003e\u0026quot;return process.mainModule.require('child_process').execSync('whoami').toString()\u0026quot;\u003c/code\u003e from the PoC, is passed as an argument to the \u003ccode\u003eFunction\u003c/code\u003e constructor.\u003c/li\u003e\n\u003cli\u003eThis action dynamically creates a new JavaScript function object containing the attacker's supplied code, which includes a call to \u003ccode\u003echild_process.execSync\u003c/code\u003e for command execution.\u003c/li\u003e\n\u003cli\u003eThe newly created malicious function is then assigned to a Velocity template variable (e.g., \u003ccode\u003e$f\u003c/code\u003e) using the \u003ccode\u003e#set\u003c/code\u003e directive.\u003c/li\u003e\n\u003cli\u003eThe Velocity template subsequently invokes this variable (\u003ccode\u003e$f()\u003c/code\u003e), triggering the execution of the embedded system command (\u003ccode\u003ewhoami\u003c/code\u003e in the PoC) on the underlying operating system and allowing the attacker to receive its output.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eApplications using \u003ccode\u003evelocityjs\u003c/code\u003e versions \u0026lt;= 2.1.6 are at severe risk of full server compromise. A successful exploitation allows an attacker to execute arbitrary shell commands with the privileges of the vulnerable application, potentially leading to the theft of sensitive data, access to cloud credentials, and the ability to pivot to other systems within the internal network. The vulnerability's nature as an RCE means direct control over the host system, making it a critical threat to any organization deploying affected \u003ccode\u003evelocityjs\u003c/code\u003e applications. The previous fix for prototype pollution (GHSA-j658-c2gf-x6pq) was bypassed, making this a more severe RCE rather than just data manipulation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of \u003ccode\u003evelocityjs\u003c/code\u003e to version 2.1.7 or later immediately to apply the patch mentioned in the references.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect suspicious process creation patterns indicative of RCE attempts originating from Node.js applications.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive \u003ccode\u003eprocess_creation\u003c/code\u003e logging for all Node.js application servers to capture details such as parent process, image path, and command line arguments.\u003c/li\u003e\n\u003cli\u003eBlock the malicious Velocity template syntax identified in the IOCs at application input layers if immediate patching is not feasible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T16:31:34Z","date_published":"2026-07-24T16:31:34Z","id":"https://feed.craftedsignal.io/briefs/2026-07-velocityjs-rce-bypass/","summary":"Velocity.js versions up to 2.1.6 are vulnerable to Remote Code Execution (RCE) through an incomplete fix for a previous prototype pollution vulnerability, enabling attackers to craft malicious Velocity templates to leverage unfiltered property-read expressions and execute arbitrary JavaScript code on the server, leading to full server compromise.","title":"Velocity.js Remote Code Execution via Function Constructor Bypass","url":"https://feed.craftedsignal.io/briefs/2026-07-velocityjs-rce-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Velocityjs \u003c= 2.1.6","version":"https://jsonfeed.org/version/1.1"}