CVE-2026-111172
@casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath
stalniy @casl/ability
CVSS
6.0MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 7.0.2@casl/abilityCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.
Text from CVE List
Affected versions 1
- @casl/abilityaffected: 6.7.5 before 7.0.2CVE List
References 5
- github.com/stalniy/casl/commit/58242cb3c7911c8a89bacfb7d732701d81bc1324Fixvia CVE List
- github.com/stalniy/casl/pull/1305Fixvia CVE List
- vulncheck.com/advisories/casl-ability-6.7.5-before-7.0.2-prototype-pollution-via-rulestofields-setbypathAdvisoryvia CVE List
- github.com/stalniy/casl/blob/80f2380d03cfe9b162685d510ba8bc0ce83d0598/packages/casl-ability/src/utils.ts#L11-L29Referencevia CVE List
- github.com/stalniy/caslReferencevia CVE List