{"action":"Upgrade @casl/ability to 6.7.5 or later.","affected":[{"fixed":"6.7.5","introduced":"2.4.0"}],"component":"@casl/ability","cve_ids":["CVE-2026-1774"],"ecosystem":"npm","epss":0.00704,"exploited":false,"fixed_versions":["6.7.5"],"ghsa_id":"GHSA-x9vf-53q3-cvx6","id":"tcs_01M5KGHJ95HDJ3RMC1QWYJ5W08","modified_at":"2026-02-11T19:26:17.624339Z","published_at":"2026-02-10T18:30:38Z","references":["https://osv.dev/vulnerability/GHSA-x9vf-53q3-cvx6","https://nvd.nist.gov/vuln/detail/CVE-2026-1774","https://github.com/stalniy/casl/pull/1093","https://github.com/stalniy/casl/commit/39da920ec1dfadf3655e28bd0389e960ac6871f4","https://cwe.mitre.org/data/definitions/1321.html","https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution","https://github.com/stalniy/casl","https://github.com/stalniy/casl/tree/master/packages/casl-ability","https://www.kb.cert.org/vuls/id/458422"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-x9vf-53q3-cvx6","url":"https://osv.dev/vulnerability/GHSA-x9vf-53q3-cvx6"}],"summary":"CASL Ability is Vulnerable to Prototype Pollution"}