26 matches found
@adula/kit (>=0.2.0-alpha.1, <=1.2.0), @dbu6/app (>=0.1.0, <=0.3.2) +4 more potentially affected by CVE-2026-111172 via @casl/ability (>=7.0.0, <=7.0.1)
@casl/ability NPM version =7.0.0, =0.2.0-alpha.1, =0.1.0, =0.1.0, =0.0.0, =0.149.0, =2.0.0, =2.1.0 Source cves: CVE-2026-111172 Source advisory: SNYK:JS-CASLABILITY-21194225...
Prototype Pollution
Overview @casl/ability is a CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access Affected versions of this package are vulnerable to Prototype Pollution via the rulesToFields function and setByPath utility, which fail to restrict...
CVE-2026-111172
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide,...
CVE-2026-111172 @casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide,...
CVE-2026-111172
The @casl/ability library (versions 6.7.5 before 7.0.2 ) is vulnerable to a prototype pollution flaw within the rulesToFields() function. Attackers who can control rule conditions can provide dotted condition keys, such as toString.call, to modify inherited builtins process-wide. This manipulatio...
EUVD-2026-102299
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide,...
CVE-2026-111172 @casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide,...
@adula/kit (>=0.2.0-alpha.1, <=1.2.0), @dbu6/app (>=0.1.0, <=0.3.2) +4 more potentially affected by CVE-2026-111172 via @casl/ability (>=7.0.0, <=7.0.1)
@casl/ability NPM version =7.0.0, =0.2.0-alpha.1, =0.1.0, =0.1.0, =0.0.0, =0.149.0, =2.0.0, =2.1.0 Source cves: CVE-2026-111172 Source advisory: MEND:CVE-2026-111172...
CVE-2026-111172
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide,...
CVE-2026-111172 @casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide,...
CVE-2026-111172: Improperly Controlled Modification of Object Prototype Attributes
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide,...
PT-2026-115178
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide,...
ROOT-APP-NPM-CVE-2026-1774 CVE-2026-1774 in @casl/ability - Patched by Root
Root has patched CVE-2026-1774 in the @casl/ability package for Root:npm. Multiple fixed versions available...
CVE-2026-1774
CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability...
@abip/scp-common (1.0.1-alpha.0), @aftership/automizely-rbac-react (>=0.1.0, <=0.6.1) +407 more potentially affected by CVE-2026-1774 via @casl/ability (>=2.4.2, <=6.7.3)
@casl/ability NPM version =2.4.2, =0.1.0, =3.7.0, =0.2.0, =0.3.1, =4.25.19-patch.1, =0.0.1, =0.0.1, =0.1.0, =1.7.0, =2.16.15 and more Source cves: CVE-2026-1774 Source advisory: OSV:GHSA-X9VF-53Q3-CVX6...
@abip/scp-common (1.0.1-alpha.0), @aftership/automizely-rbac-react (>=0.1.0, <=0.6.1) +407 more potentially affected by CVE-2026-1774 via @casl/ability (>=2.4.2, <=6.7.3)
@casl/ability NPM version =2.4.2, =0.1.0, =3.7.0, =0.2.0, =0.3.1, =4.25.19-patch.1, =0.0.1, =0.0.1, =0.1.0, =1.7.0, =2.16.15 and more Source cves: CVE-2026-1774 Source advisory: GHSA-X9VF-53Q3-CVX6...
Prototype Pollution
Overview @casl/ability is a CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access Affected versions of this package are vulnerable to Prototype Pollution via the rulesToFields which handles object properties. An attacker can inject...
@abip/scp-common (1.0.1-alpha.0), @aftership/automizely-rbac-react (>=0.1.0, <=0.6.1) +407 more potentially affected by CVE-2026-1774 via @casl/ability (>=2.4.2, <=6.7.3)
@casl/ability NPM version =2.4.2, =0.1.0, =3.7.0, =0.2.0, =0.3.1, =4.25.19-patch.1, =0.0.1, =0.0.1, =0.1.0, =1.7.0, =2.16.15 and more Source cves: CVE-2026-1774 Source advisory: SNYK:JS-CASLABILITY-15268419...