CVE-2026-111172: @casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Node.js applications using affected @casl/ability versions are exposed when an attacker can control rule conditions that are passed to rulesToFields(). The impact is process-wide because inherited built-in functions can be modified.
What does an attacker need to exploit it?
The attacker needs the ability to supply crafted dotted condition keys in rule conditions, such as "toString.call". No user interaction is required, but the attack complexity is rated high and low privileges are required.
What is the practical impact?
A successful attack can alter shared built-in functions and cause denial of service for the Node.js process. The provided severity vector indicates no confidentiality or integrity impact.
Which versions should be remediated?
The affected range is @casl/ability 6.7.5 before 7.0.2. Upgrade to 7.0.2 or later.