CVE-2026-111172

CVSS 6.0 (medium) · published 2026-10-15

@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.

Weakness: CWE-1321

Source: NVD CVE-2026-111172

References

• https://github.com/stalniy/casl
• https://github.com/stalniy/casl/blob/80f2380d03cfe9b162685d510ba8bc0ce83d0598/packages/casl-ability/src/utils.ts#L11-L29
• https://github.com/stalniy/casl/commit/58242cb3c7911c8a89bacfb7d732701d81bc1324
• https://github.com/stalniy/casl/pull/1305
• https://www.vulncheck.com/advisories/casl-ability-6.7.5-before-7.0.2-prototype-pollution-via-rulestofields-setbypath

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.