@casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath

Summary

@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.

Evidence

Reported to the maintainer with a proof of concept that reproduced against the affected release.

Remediation

Upgrade @casl/ability to 7.0.2 or later.

References

• VulnCheck advisoryhttps://www.vulncheck.com/advisories/casl-ability-6.7.5-before-7.0.2-prototype-pollution-via-rulestofields-setbypath
• Fix commithttps://github.com/stalniy/casl/commit/58242cb3c7911c8a89bacfb7d732701d81bc1324
• Fix pull requesthttps://github.com/stalniy/casl/pull/1305
• Vulnerable codehttps://github.com/stalniy/casl/blob/80f2380d03cfe9b162685d510ba8bc0ce83d0598/packages/casl-ability/src/utils.ts#L11-L29
• CVE recordhttps://www.cve.org/CVERecord?id=CVE-2026-111172