Skip to content
OpenAdvisories

Vendor

stalniy

1 known vulnerabilities.

Products

@casl/ability 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-111172

    @casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath

    @casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter …

    stalniy @casl/ability