Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| velocityjs | npm | <= 2.1.5 |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions that the prototype pollution occurs in the #set path assignment logic within src/compile/set.ts. The advisory states that versions <= 2.1.5 are vulnerable. By comparing the git tags for version v2.1.5 and the subsequent version v2.1.6, I identified a commit b9a030d02a579b31ada6670a82acc03d308d35fc with the message "fix: guard set paths against prototype pollution". Analysis of this commit's changes to src/compile/set.ts confirms the vulnerability. The SetValue.render method was modified to add path validation. The original, vulnerable code directly iterated through the provided path and assigned the value, allowing malicious keys like __proto__ to be used. The patch introduces a new function, resolveSetPath, which validates the path against a blocklist of keys (__proto__, constructor, prototype) before any assignment is made. The vulnerable function is SetValue.render as it contained the logic that processed the malicious input and performed the unsafe assignment.
