Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck
CVE-2026-111172@casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath
Medium 5.3
In plain English
A medium-severity prototype pollution in @casl/ability from stalniy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 67.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| stalniy | @casl/ability | 6.7.5 – before 7.0.2 |
Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/stalniy/casl/commit/58242cb3c7911c8a89bacfb7d732701d81bc1324 patch
- https://github.com/stalniy/casl/pull/1305 patch, issue-tracking
- https://github.com/stalniy/casl/blob/80f2380d03cfe9b162685d510ba8bc0ce83d0598/packages/casl-ability/src/utils.ts#L11-L29 technical-description
- https://github.com/stalniy/casl product
- VulnCheck Advisory: @casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath third-party-advisory