CVE-2026-111172 in ability
Summary
by MITRE • 10/15/2026
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The @casl/ability library is a widely used permission management tool in JavaScript and TypeScript applications, providing developers with an API to define user abilities based on roles or specific conditions. Versions prior to 7.0.2 contain a critical prototype pollution vulnerability within the rulesToFields function. This flaw arises from how the library processes condition keys that utilize dot notation. When attackers can control these rule conditions, they are able to inject malicious property names such as toString.call into the object structure being processed by the library. Because JavaScript objects inherit properties from their prototypes, and many libraries do not properly sanitize or isolate input when merging nested objects, this injection allows an attacker to write directly onto the Object.prototype chain rather than just within a local scope.
This prototype pollution mechanism enables attackers to modify shared built-in functions process-wide. By altering fundamental methods like toString on the global object prototype, the integrity of all subsequent JavaScript operations that rely on these standard library features is compromised. The impact is severe because it does not require direct code execution in the traditional sense but instead corrupts the runtime environment itself. Any part of the application or any other module running within the same Node.js process will begin to behave unpredictably as core methods return unexpected values or throw errors due to their internal logic being overwritten by attacker-controlled data.
The operational impact of this vulnerability is primarily a denial of service against the entire Node.js process. As the prototype pollution spreads, it causes widespread failures in string conversions and other standard operations that depend on the original implementation of Object.prototype methods. This leads to application crashes or unresponsive states, effectively taking down any web services or API endpoints relying on the affected version of @casl/ability. The severity is heightened by the fact that this can be triggered through user-supplied input if rule conditions are derived from external sources without sufficient validation, making it a potential remote attack vector in applications where users can influence permission rules.
To mitigate this vulnerability, organizations must upgrade to version 7.0.2 or later of @casl/ability, which includes fixes for the prototype pollution issue by properly handling object merging and sanitizing input keys. In environments where upgrading is not immediately feasible, developers should implement strict validation on all rule conditions before they are passed to the library functions. This involves ensuring that condition keys do not contain dot notation or special characters that could be interpreted as property paths leading to built-in prototypes. Additionally, using Object.create(null) for intermediate objects during processing can help isolate data from the prototype chain, although upgrading remains the most effective and recommended remediation strategy.
This vulnerability is classified under CWE-1325: Improper Check of Uncommonly Used Security Constraint as it involves a flaw in checking inputs against expected constraints regarding object structure. It also aligns with MITRE ATT&CK technique T1059, specifically Command Line Interface or Scripting Interpreter abuse, where the attacker manipulates the environment to cause disruption rather than direct exploitation for data theft. The incident highlights the importance of rigorous input validation and secure coding practices in JavaScript libraries that handle dynamic object structures, particularly those involved in security-critical functions like access control management.