CVE-2026-1774 – CASL Ability Remote Code Execution Vulnerability
“A weakness in a widely used authorization library could allow attackers to inject malicious code and take control of affected applications.”
This patch addresses a critical vulnerability (CVE-2026-1774) affecting CASL Ability, a JavaScript authorization library used to manage access control in web applications. The issue stems from improper validation of user-supplied input when defining or evaluating authorization rules.
An attacker could exploit this weakness by crafting malicious input that manipulates how authorization logic is processed. Successful exploitation may allow remote code execution within the application environment, potentially enabling attackers to bypass access controls, manipulate application behavior, or gain control of the underlying server. CVE-2026-1774 carries a CVSS v3.1 score of 9.8 (Critical).
Security updates address the issue by strengthening input validation and improving how authorization rules are processed within the CASL Ability library. Applications using vulnerable versions remain exposed until the patched release is applied.