The vulnerability is a prototype pollution flaw triggered by the #set directive in Velocity.js. An attacker who can supply a template that includes a malicious #set will cause the JavaScript runtime to overwrite properties on Object.prototype. This manipulation can corrupt shared object state and lead to a denial of service or, depending on the execution environment, possible remote code execution. The flaw maps to CWE‑1321.

Affected products are velocity.js version 2.1.5 and all earlier releases, distributed by shepherdwind. Any application that renders attacker‑controlled Velocity templates using these versions is at risk.

The score of 8.3 indicates a high‑severity flaw. No EPSS data is available, and the vulnerability is not yet listed in CISA KEV, although its impact warrants caution. Exploitation requires only the ability to influence the template; typical attack paths involve user‑generated content, form submissions, or API payloads that are parsed as Velocity templates.