9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1774

CVE-2026-1774: CASL Ability is Vulnerable to Prototype Pollution

CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1774

CVE-2026-1774:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@casl/ability	npm	>= 2.4.0, <= 6.7.4	6.7.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a prototype pollution issue within the setByPath utility function in @casl/ability. This function is used to set nested properties on an object using a string path. The vulnerability occurs because, prior to the patch, setByPath did not sanitize or validate the property names within the path. An attacker could provide a path containing __proto__, constructor, or prototype to modify the Object.prototype.

The primary function that exposes this vulnerability is rulesToFields, which is part of the public API. This function takes CASL rules and uses setByPath to transform them into a different object structure. If an attacker can control the conditions of the rules passed to rulesToFields, they can craft a malicious path (e.g., { "__proto__.isAdmin": true }) that will be processed by setByPath, leading to prototype pollution. This could allow them to escalate privileges or cause a denial of service by modifying the behavior of all objects in the application.

The patch addresses this by introducing a FORBIDDEN_PROPERTIES set containing __proto__, constructor, and prototype. The setByPath function was modified to check each part of the property path against this set, refusing to process any forbidden properties and thus preventing the pollution.

Vulnerable functions

setByPath

packages/casl-ability/src/utils.ts

This function is responsible for setting a property on an object based on a path. Before the patch, it did not validate the property names in the path, allowing an attacker to provide a path like `__proto__.polluted` to modify the `Object.prototype` and pollute it with new properties. The patch introduces a blocklist of forbidden properties (`__proto__`, `constructor`, `prototype`) to prevent this.

rulesToFields

packages/casl-ability/src/extra.ts

This function processes ability rules and converts them into a field-based object representation. It uses the vulnerable `setByPath` function internally to construct this object. When processing rules with specially crafted conditions containing property paths like `__proto__`, it passes these paths to `setByPath`, leading to prototype pollution. The test added in the patch confirms this is the intended attack vector being fixed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.