Velocity.js versions before 2.1.7 have an improper control of code generation vulnerability (CWE-94) due to incomplete filtering of property-read expressions in the template engine's code. While the earlier fix for CVE-2026-44966 filtered dangerous properties in the #set assignment handler, property-read expressions in src/compile/references.ts remained unfiltered. This allowed attacker-controlled templates to traverse constructor.constructor to the JavaScript Function constructor, enabling arbitrary code execution on the server. The vulnerability permits execution of shell commands and unauthorized access to environment variables, cloud credentials, and internal network resources. The vulnerability is resolved in version 2.1.7.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the server running Velocity.js, leading to full compromise of the server environment. This includes executing shell commands, accessing sensitive environment variables, cloud credentials, and internal network resources, resulting in complete confidentiality, integrity, and availability loss.

Upgrade Velocity.js to version 2.1.7 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed by the vendor advisory stating the issue is fixed in 2.1.7.