CVE-2026-111172: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in stalniy @casl/ability

The vulnerability in @casl/ability (6.7.5 <7.0.2) is a prototype pollution issue in the rulesToFields() function. Attackers controlling rule conditions can supply dotted keys that modify inherited built-in object prototypes, such as 'toString.call'. This manipulation affects shared built-in functions process-wide in Node.js, leading to denial of service conditions. The CVSS 4.0 score is 6.0 (medium severity), reflecting network attack vector, high attack complexity, partial privileges required, and high impact on availability.

Successful exploitation allows an attacker with partial privileges to modify built-in JavaScript object prototypes used by the Node.js process. This can disrupt normal function calls and cause denial of service, impacting availability of applications using the vulnerable @casl/ability versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions or restrict inputs controlling rule conditions to prevent injection of dotted keys that could trigger prototype pollution.