CASL Ability versions 2.4.0 through 6.7.4 include a prototype pollution flaw that allows attackers to write arbitrary properties onto shared object prototypes. This can lead to subtle changes in application logic, potential denial of service, or more severe consequences if the polluted properties influence control flow or authentication checks. The vulnerability is a classic example of CWE‑1321: Prototype Pollution.

The affected product is CASL Ability, a JavaScript authorization library. The vulnerable releases span from 2.4.0 up to and including 6.7.4. Users employing any of these versions are potentially at risk; the product should be treated as compromised until a neutralized version is deployed.

The advisory rates the issue with a CVSS score of 9.8, indicating high severity. EPSS indicates a very low but non‑zero likelihood of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. The most probable attack vector is through web application code that loads the library or accepts user input that is processed by it, allowing an attacker to inject malicious prototype modifications. Because prototype pollution can affect globally shared objects, a successful exploit could bypass access controls or corrupt application state.