Skip to content

CVE record · 1 source

CVE-2026-111172

CVSS 5.3

@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins…

Vendor: Node.js
Product: Node.js
CVSS: 5.3
Exposure class: Developer platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

8

CVE NVD 21d ago

@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins…

@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys…

CVSS 5.3 CVE-2026-111172 Node.js