CVE-2026-111172

The @casl/ability library (versions 6.7.5 before 7.0.2 ) is vulnerable to a prototype pollution flaw within the rulesToFields() function. Attackers who can control rule conditions can provide dotted condition keys, such as toString.call, to modify inherited builtins process-wide. This manipulatio...

CVE-2026-111172 @casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath

@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide,...

Prototype Pollution

Overview @casl/ability is a CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access Affected versions of this package are vulnerable to Prototype Pollution via the rulesToFields which handles object properties. An attacker can inject...