GHSA-j658-c2gf-x6pq Velocity.js has a Prototype Pollution vulnerability through #set path assignment

• npm velocityjs: <= 2.1.5 (no fix yet)

Summary A prototype pollution vulnerability was discovered in Velocity.js )[key] = val`. Because there is no validation or filtering to block sensitive keys such as \_\_proto\_\_, constructor, or prototype, an attacker can traverse the prototype chain and pollute the global Object.prototype. PoC ```javascript const {render} = require('velocityjs'); delete Object.prototype.polluted; console.log({}.polluted); // "" render('#set($__proto__.polluted = "hacked")', {}); console.log({}.polluted); // "hacked" delete Object.prototype.polluted; ``` Impact • Vulnerability Type: Prototype Pollution • Who is impacted: Any application that renders Velocity templates where the template content can be influenced or controlled by untrusted users. • Severity: High. Prototype pollution can often be used to bypass security controls, cause application crashes (DoS), or be chained with other vulnerabilities to achieve code execution.