What’s Vulnerable › Vulnerabilities

CVE-2026-111172: @casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-15 · updated 2026-10-16
• Weakness: CWE-1321

Description

@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.

Affected products

• stalniy @casl/ability: from 6.7.5 before 7.0.2 — fixed in 7.0.2

How to fix

Upgrade to a fixed version: stalniy @casl/ability 7.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/stalniy/casl
• https://github.com/stalniy/casl/blob/80f2380d03cfe9b162685d510ba8bc0ce83d0598/packages/casl-ability/src/utils.ts#L11-L29
• https://github.com/stalniy/casl/commit/58242cb3c7911c8a89bacfb7d732701d81bc1324
• https://github.com/stalniy/casl/pull/1305
• https://www.vulncheck.com/advisories/casl-ability-6.7.5-before-7.0.2-prototype-pollution-via-rulestofields-setbypath

Get alerted when CVE-2026-111172 or the next vulnerability affects your stack