Prototype pollution in @casl/ability via rulesToFields
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
@casl/ability from 6.7.5 before 7.0.2 contains a prototype pollution flaw in rulesToFields(), tracked as CWE-1321. Attackers who control rule conditions can use dotted keys such as 'toString.call' to modify shared builtin functions across the whole Node.js process, causing a denial of service for that process.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update @casl/ability to version 7.0.2, which is the fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA @casl/ability (stalniy) Fixed in 7.0.2
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111172
- 2026-10-16 Priority changed: MEDIUM → LOW
- 2026-10-16 CISA SSVC decision points changed
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences