CVE-2026-1774: CASL Ability Prototype Pollution Vulnerability
Summary
CVE-2026-1774: CASL Ability is Vulnerable to Prototype Pollution. Affects @casl/ability versions >= 2.4.0, < 6.7.5. Fixed in 6.7.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CASL Ability is a popular library in the npm ecosystem that provides a powerful and flexible way to manage permissions and access control in JavaScript applications. It allows developers to define rules for what actions users can perform based on their roles and attributes. However, versions 2.4.0 through 6.7.4 of this library are vulnerable to a prototype pollution issue, which can lead to serious security risks if exploited.
Vulnerability Detail
The vulnerability in CASL Ability arises from improper handling of user input, allowing an attacker to modify the prototype of built-in objects. This can lead to unexpected behavior in the application, including the ability to manipulate or access sensitive data. The issue is classified under CWE-1321, which pertains to prototype pollution. If exploited, this vulnerability can compromise the integrity and security of the application, making it critical to address.
How To Fix
Latest published version: 7.0.2 as of 22 Oct 2026
npm install @casl/ability@7.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.7.5
This is the first release that contains the fix.
npm install @casl/ability@6.7.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider implementing input validation to sanitize user inputs and prevent prototype pollution. This can help mitigate the risk until a proper update can be applied.
Conclusion
The CASL Ability library has a critical vulnerability (CVE-2026-1774) that allows for prototype pollution, affecting versions 2.4.0 through 6.7.4. It is essential to update to version 6.7.5 or later to mitigate this risk. Additionally, consider using Vulert for ongoing monitoring of your dependencies.
See every vulnerability recorded for @casl/ability →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate the prototype of an object, potentially leading to unexpected behavior in applications.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without needing to sign up.
Exploiting this vulnerability can lead to unauthorized access to sensitive data, manipulation of application behavior, and potential data breaches.
Yes, Vulert can monitor your package-lock.json file to alert you in real-time for open-source vulnerabilities in your software.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
