CVEvulnerability
CVE-2026-111172
6.0 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-10-15
- Last modified
- 2026-10-16
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 6.0 MEDIUM — CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1321
Description
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.
Related
Weakness · CWE (1)
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
References
- https://github.com/stalniy/casl github.com
- https://github.com/stalniy/casl/blob/80f2380d03cfe9b162685d510ba8bc0ce83d0598/packages/casl-ability/src/utils.ts#L11-L29 github.com
- https://github.com/stalniy/casl/commit/58242cb3c7911c8a89bacfb7d732701d81bc1324 github.com
- https://github.com/stalniy/casl/pull/1305 github.com
- https://www.vulncheck.com/advisories/casl-ability-6.7.5-before-7.0.2-prototype-pollution-via-rulestofields-setbypath www.vulncheck.com