---
id: CVE-2026-111172
title: >-
  @casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability
  in rulesToFields() that allows attackers to modify inherited builtins via
  dotted condition keys
summary: >-
  @casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability
  in rulesToFields() that allows attackers to modify inherited builtins via
  dotted condition keys. Attackers controlling rule conditions can supply keys
  like 'to…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-1321
vendor: stalniy
product: '@casl/ability'
affected:
  - '@casl/ability >= 6.7.5 < 7.0.2'
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:33.450'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111172'
references:
  - url: 'https://github.com/stalniy/casl'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/stalniy/casl/blob/80f2380d03cfe9b162685d510ba8bc0ce83d0598/packages/casl-ability/src/utils.ts#L11-L29
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/stalniy/casl/commit/58242cb3c7911c8a89bacfb7d732701d81bc1324
    label: disclosure@vulncheck.com
  - url: 'https://github.com/stalniy/casl/pull/1305'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/casl-ability-6.7.5-before-7.0.2-prototype-pollution-via-rulestofields-setbypath
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T19:25:46.425Z'
---

## Overview

@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.