The vulnerability in shepherdwind's velocity.js (CVE-2026-73649) is a code injection flaw due to improper control of code generation. An earlier fix for CVE-2026-44966 filtered certain properties only in the #set assignment handler but did not filter property-read expressions in src/compile/references.ts. The getReferences() function calls getAttributes(), which allows traversal to the JavaScript Function constructor through constructor.constructor. Because the #set handler validated only the assignment target and not the right-hand property-read expression, an attacker-controlled template can execute arbitrary code, including shell commands and access to environment variables, cloud credentials, and internal network resources. This vulnerability is resolved in velocity.js version 2.1.7.

Successful exploitation allows remote attackers to execute arbitrary code on the server running velocity.js, potentially leading to full system compromise, unauthorized access to environment variables, cloud credentials, and internal network resources. The CVSS score of 9.8 reflects the critical severity with high impact on confidentiality, integrity, and availability.

Upgrade velocity.js to version 2.1.7 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the fixed version 2.1.7.