CVE-2026-111172
CVE-2026-111172 · @casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath
This page contains facts from public vulnerability sources. Check the original advisory before updating.
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.
CVSS 6.0 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
@casl/ability
- Versions
- ≥ 6.7.5, < 7.0.2: Affected (semver)
Update to 7.0.2
Original sources
- https://github.com/stalniy/casl/commit/58242cb3c7911c8a89bacfb7d732701d81bc1324
- https://github.com/stalniy/casl/pull/1305
- https://github.com/stalniy/casl/blob/80f2380d03cfe9b162685d510ba8bc0ce83d0598/packages/casl-ability/src/utils.ts#L11-L29
- https://github.com/stalniy/casl
- https://www.vulncheck.com/advisories/casl-ability-6.7.5-before-7.0.2-prototype-pollution-via-rulestofields-setbypath
- https://nvd.nist.gov/vuln/detail/CVE-2026-111172