Prototype Pollution in @casl/ability Affecting Stalniy Products
CVE-2026-111172

6MEDIUM

Key Information:

Vendor

Stalniy

Status
@casl/ability
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111172?

@casl/ability versions 6.7.5 and earlier are susceptible to a prototype pollution vulnerability in the rulesToFields() function. This flaw allows attackers to manipulate inherited built-in objects by injecting malicious keys through dotted condition keys. Consequently, attackers could use keys such as 'toString.call' to modify fundamental functions across the entire Node.js process, potentially leading to a denial of service.

Affected Version(s)

@casl/ability 6.7.5 < 7.0.2

References

https://github.com/stalniy/casl/commit/58242cb3c7911c8a89...
patch
https://github.com/stalniy/casl/pull/1305
patchissue-tracking
https://github.com/stalniy/casl/blob/80f2380d03cfe9b16268...
technical-description

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani
.