PT-2026-7279 · Unknown · Casl Ability

Alma Security + 3 · Publicado 2026-02-10 · Atualizado 2026-02-12 · CVE-2026-1774

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CASL Ability versions 2.4.0 through 6.7.4

Description CASL Ability contains a prototype pollution vulnerability. This issue affects versions 2.4.0 through 6.7.4. Prototype pollution occurs when an attacker manipulates the properties of JavaScript objects, potentially leading to denial of service or unauthorized access.

Recommendations Update CASL Ability to a version later than 6.7.4.

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2026-1774

GHSA-X9VF-53Q3-CVX6

Produtos afetados

Casl Ability

Referências · 12

• https://github.com/stalniy/casl/pull/1093 · Nota
• https://github.com/stalniy/casl/commit/39da920ec1dfadf3655e28bd0389e960ac6871f4 · Nota
• https://github.com/stalniy/casl · Nota
• https://github.com/stalniy/casl/tree/master/packages/casl-ability · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1774 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1r2tzxw/resumen_diario_de_vulnerabilidades_12022026 · Publicação no Reddit
• https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution · Nota
• https://osv.dev/vulnerability/GHSA-x9vf-53q3-cvx6 · Aviso do Fabricante
• https://kb.cert.org/vuls/id/458422 · Nota
• https://twitter.com/_cvereports/status/2021806493394202840 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2021627413902569900 · Publicação no Twitter
• https://cwe.mitre.org/data/definitions/1321.html · Nota