stalniy CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM stalniy CVE published 2026-10-15

CVE-2026-111172

A prototype pollution vulnerability exists in @casl/ability versions 6.7.5 before 7.0.2. This vulnerability allows attackers to modify inherited builtins via dotted condition keys, potentially causing denial of service for the Node.js process. The vulnerability is caused by a flaw in the rulesToFields() function, which allows attackers to supply keys like 'toString.call' to alter shared builtin functions [truncated]