@casl/ability CVE-2026-111172

Exploitation requires that the application (1) uses @casl/ability between 6.7.5 and 7.0.2, (2) calls rulesToFields() on an ability, and (3) allows an attacker to control the keys of a rule's conditions object so that a dotted key such as 'toString.call', 'hasOwnProperty', or 'valueOf' can be supplied. The dotted path is then expanded via the internal setByPath helper and reaches an inherited builtin, mutating Object.prototype members shared across the whole process. Limiting factors: the attacker must have write influence over rule-condition construction (PR:L - typically a server-side or privileged operation, not raw external input), the CVSS 4.0 vector marks High attack complexity and a Present attack requirement (AC:H/AT:P), and the impact is confined to availability (process DoS) with no confidentiality or integrity consequence. Applications that never expose rule-condition keys to untrusted data, or that do not use rulesToFields(), are not exploitable.

This is a moderate-severity, availability-only issue, not an urgent priority. The supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) scores 6.0 and limits impact to availability (VA:H) with no confidentiality or integrity effect (VC:N/VI:N) - consistent with a prototype-pollution bug that corrupts shared Node.js builtins to crash the process rather than achieve RCE or data theft. Exploitation is gated by High attack complexity (AC:H), a Present attack requirement (AT:P), and Low privileges (PR:L), meaning the attacker must already be able to supply CASL rule conditions, which in most deployments is a privileged/server-side operation rather than arbitrary external input. No EPSS score, KEV listing, or POC indicator is present in the input, so there is no signal of active or widespread exploitation - the disclosure comes from VulnCheck research with a vendor patch. Net assessment: a real but conditional DoS affecting applications that feed attacker-influenceable conditions into rulesToFields(); treat as a dependency-hygiene patch rather than an emergency. NOTE: the real-world PR level depends entirely on whether the host application exposes rule-condition construction to untrusted actors - verify in your own code path.

An attacker who can influence the condition objects of CASL rules (for example an application that builds authorization rules from user-supplied filter/query input) submits a dotted key such as 'toString.call' with a value. When the application calls rulesToFields() to derive field defaults, the dotted key walks into and overwrites a shared builtin function on Object.prototype process-wide, corrupting it for all code and crashing or destabilizing the Node.js process. No public exploit identified at time of analysis, and the network-reachable path still carries high attack complexity (AC:H).