Velocity.js and its template engine allow an attacker to inject a property‑read expression that resolves to the JavaScript Function constructor, giving the attacker the ability to execute arbitrary shell commands, read environment variables, access cloud credentials, and reach internal network resources from the process running the server. The vulnerability is characterized as a code injection flaw (CWE‑94) and is rated with a CVSS score of 9.8, indicating a critical level of severity.

The vulnerability is present in all released versions of the shepherdwind Velocity.js library prior to version 2.1.7. Any deployment that incorporates Velocity.js before the 2.1.7 release is susceptible; only upgrades to 2.1.7 or later provide the fix.

The CVSS score conveys a high risk of exploitation, while the EPSS value is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. Attackers can exploit the flaw by supplying a crafted template to the rendering engine, which must be accessible to them. If an application renders untrusted templates, the potential for remote code execution is direct and immediate, but the attack surface is limited to systems that expose template content to attackers.