A code injection vulnerability in velocity.js allows remote attackers to execute arbitrary commands by exploiting insufficient filtering of property-read expressions.

The vulnerability stems from improper control of code generation (CWE-94) within property-read expressions. Because the library fails to adequately validate right-hand expressions in templates, an attacker can traverse to the JavaScript Function constructor, resulting in arbitrary command execution within the server process.

The CVSS score of 9.8 (Critical) reflects the ability for an attacker to achieve remote code execution. This can lead to total system compromise, including the theft of cloud credentials, access to internal networks, and full control over the underlying server environment.

Immediate Action: Update the velocity.js package to version 2.1.7 or later to implement the necessary security filters.

Proactive Monitoring: Monitor server process activity and outbound network connections for anomalous behavior that may indicate shell command execution or unauthorized access to environment variables.

Compensating Controls: Implement strict input validation for any templates processed by the library and ensure the application process runs with the principle of least privilege.

Public Exploit Available: No (unknown)

Given the potential for remote code execution, developers should update their dependencies to velocity.js version 2.1.7 immediately. Failure to patch allows a significant entry point for attackers to gain full control over the application server.