{"id":"CVE-2026-1774","aliases":["EUVD-2026-7071","GHSA-x9vf-53q3-cvx6","ROOT-APP-NPM-CVE-2026-1774"],"status":"published","title":"CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.","description":"CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00704,"percentile":0.53813,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2026-02-10T15:38:03Z","modified":"2026-10-08T10:15:03Z","fixes":[{"ecosystem":"npm","package":"@casl/ability","fixed_in":["6.7.5"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@casl/ability","fixed_in":["6.7.2-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/casl__ability","fixed_in":["6.7.2-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@casl/ability","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"last_affected":"6.7.4"},{"fixed":"6.7.5"}]}]},{"source":"osv","ecosystem":"npm","package":"@casl/ability","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"6.7.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@casl/ability","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.2-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/casl__ability","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.2-root.io.1"}]}]}],"products":[{"vendor":"casl ability","product":"casl ability"}],"references":[{"url":"https://github.com/stalniy/casl/tree/master/packages/casl-ability","tags":["web"]},{"url":"https://cwe.mitre.org/data/definitions/1321.html","tags":["web"]},{"url":"https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution","tags":["web"]},{"url":"https://www.kb.cert.org/vuls/id/458422","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1774","tags":["advisory"]},{"url":"https://github.com/stalniy/casl/pull/1093","tags":["web"]},{"url":"https://github.com/stalniy/casl/commit/39da920ec1dfadf3655e28bd0389e960ac6871f4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x9vf-53q3-cvx6"},{"url":"https://github.com/stalniy/casl","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-1774","title":"CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.","description":"CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.","status":"published","published":"2026-02-10T15:38:03.265Z","modified":"2026-02-11T14:44:50.765Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:20:01.271368Z"}],"euvd":[{"id":"EUVD-2026-7071","description":"CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.","status":"published","published":"2026-02-10T15:38:03Z","modified":"2026-02-11T14:44:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:41.30503Z"}],"ghsa":[{"id":"GHSA-x9vf-53q3-cvx6","title":"CASL Ability is Vulnerable to Prototype Pollution","description":"CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.","status":"published","published":"2026-02-10T18:30:38Z","modified":"2026-02-11T19:09:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:39:24.742346Z"}],"nvd":[{"id":"CVE-2026-1774","description":"CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.","status":"published","published":"2026-02-10T16:16:10.74Z","modified":"2026-06-17T10:16:29.8Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:05.52517Z"}],"osv":[{"id":"GHSA-x9vf-53q3-cvx6","title":"CASL Ability is Vulnerable to Prototype Pollution","description":"CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.","status":"published","published":"2026-02-10T18:30:38Z","modified":"2026-02-11T19:26:17.624339Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"ROOT-APP-NPM-CVE-2026-1774","title":"CVE-2026-1774 in @casl/ability - Patched by Root","description":"Root has patched CVE-2026-1774 in the @casl/ability package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-08T09:59:37Z","modified":"2026-10-08T10:15:03.269212104Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}