Homepage

@casl/ability@2.0.0-alpha.ade5be4a

CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access

  • latest version

    7.0.2

  • latest non vulnerable version

    7.0.2

  • first published

    8 years ago

  • latest version published

    7 days ago

  • licenses detected

  • View ability package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @casl/ability package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Prototype Pollution

    @casl/ability is a CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access

    Affected versions of this package are vulnerable to Prototype Pollution via the rulesToFields function and setByPath utility, which fail to restrict property assignment to own properties of the accumulator object. An authenticated remote attacker can supply a condition key such as __proto__ or constructor to pollute the prototype of the returned object, causing a crash or denial of service in downstream code that relies on the polluted prototype chain.

    How to fix Prototype Pollution?

    Upgrade @casl/ability to version 7.0.2 or higher.

    <7.0.2
    Go back to all versions of this package