Executive brief
CASL Ability is a popular authorization library used to define and check permissions in JavaScript applications. A prototype pollution vulnerability allows attackers to modify the behavior of the library and potentially compromise application logic or bypass security rules without requiring authentication.
Technical details
CASL Ability versions 2.4.0 through 6.7.4 are vulnerable to prototype pollution in the rulesToFields function. The vulnerability exists in the ability-setByPath component where user-controlled input is not properly sanitized before being used to modify object properties. An unauthenticated remote attacker can exploit this via network access to inject malicious properties into JavaScript object prototypes, leading to arbitrary code execution or authorization bypass. The vulnerability was patched in version 6.7.5 via PR #1093, which implements filtering of potentially insecure fields.
Affected products
- CASL Ability 2.4.0 through 6.7.4
Timeline
- 2026-02-10: disclosed
- 2026-02-10: patched: Fix released in version 6.7.5