Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-1774 EUVD-2026-7071GHSA-x9vf-53q3-cvx6

CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.

Published Feb 10, 2026 · Updated Feb 11, 2026 · Assigned by certcc

Vendor: CASL Ability Product: CASL Ability Package: @casl/ability Ecosystem: npm

Description

CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.

Affected products

VendorProductAffectedFixed
CASL Ability CASL Ability 2.4.0 – ≤ 6.7.4 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm @casl/ability >= 2.4.0, < 6.7.5 6.7.5 GHSA-x9vf-53q3-cvx6

References