CVE-2026-1774

CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability...

@abip/scp-common (1.0.1-alpha.0), @aftership/automizely-rbac-react (>=0.1.0, <=0.6.1) +401 more potentially affected by CVE-2026-1774 via @casl/ability (>=2.4.2, <=6.7.3)

@casl/ability NPM version =2.4.2, =0.1.0, =3.7.0, =0.2.0, =0.3.1, =4.25.19-patch.1, =0.0.1, =0.0.1, =0.1.0, =1.7.0, =2.16.10 and more Source cves: CVE-2026-1774 Source advisory: OSV:GHSA-X9VF-53Q3-CVX6...

Prototype Pollution

Overview @casl/ability is a CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access Affected versions of this package are vulnerable to Prototype Pollution via the rulesToFields which handles object properties. An attacker can inject...

@abip/scp-common (1.0.1-alpha.0), @aftership/automizely-rbac-react (>=0.1.0, <=0.6.1) +401 more potentially affected by CVE-2026-1774 via @casl/ability (>=2.4.2, <=6.7.3)

@casl/ability NPM version =2.4.2, =0.1.0, =3.7.0, =0.2.0, =0.3.1, =4.25.19-patch.1, =0.0.1, =0.0.1, =0.1.0, =1.7.0, =2.16.10 and more Source cves: CVE-2026-1774 Source advisory: SNYK:JS-CASLABILITY-15268419...

CVE-2026-1774

CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability...

CVE-2026-1774

The CASL Ability library (versions 2.4.0 through 6.7.4) is vulnerable to a prototype pollution vulnerability. The flaw exists in the rulesToFields() function within the extra module, specifically due to a lack of sanitization in the setByPath() method. This allows attackers to inject arbitrary pr...

CVE-2026-1774 CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.

CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability...

CVE-2026-1774: Undefined Security Weakness

CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability...

PT-2026-7279

Name of the Vulnerable Software and Affected Versions CASL Ability versions 2.4.0 through 6.7.4 Description CASL Ability contains a prototype pollution vulnerability. This issue affects versions 2.4.0 through 6.7.4. Prototype pollution occurs when an attacker manipulates the properties of...

CASL Ability contains a prototype pollution vulnerability

Overview A prototype pollution vulnerability present in CASL Ability versions 2.4.0 through 6.7.4 is triggered through the rulesToFields function in the extra module. The program’s library contains a method called setByPath that does not properly sanitize property names, allowing attackers to add...