MEDIUMCVSS v3.1 5.3Vulnerability
CVE-2026-111172
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-20T21:14:08.448323+00:00
- Epss score
- 0.00383
- Cvss severity
- MEDIUM
- Cvss score
- 5.3
- Retrieved at
- 2026-10-21T01:24:48+00:00
- Last source
- FIRST EPSS
- Score
- 5.3
- Cvss version
- 3.1
- Cve id
- CVE-2026-111172
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- First seen by Signal
- 2026-10-18T13:39:03+00:00
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- Published at
- 2026-10-15T19:17:33.450
- Last modified
- 2026-10-16T18:25:45.343
- Epss percentile
- 0.3086
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph