Threat database

@casl/ability versions 6.7.5 up to but not including 7.0.2 contain a prototype pollution vulnerability in the rulesToFields() function. This flaw allows attackers who can control rule conditions to modify inherited built-in object properties via specially crafted dotted keys such as 'toString.call'. Exploitation can lead to denial of service of the Node.js process running the affected library.