thomaspoignant scim-patch up to 0.9.0 scimPatch Value prototype pollution

Summaryinfo

A vulnerability was found in thomaspoignant scim-patch up to 0.9.0. It has been rated as critical. This impacts the function scimPatch. This manipulation of the argument Value causes prototype pollution. This vulnerability is handled as CVE-2026-48170. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in thomaspoignant scim-patch up to 0.9.0 and classified as critical. Affected by this vulnerability is the function scimPatch. The manipulation of the argument value with an unknown input leads to a prototype pollution vulnerability. The CWE definition for the vulnerability is CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. Version 0.9.1 contains a patch. A workaround is available. Calling `Object.freeze(Object.prototype)` (and the same on `Array.prototype`, `Function.prototype`) at process startup neutralizes this class of bug — assignment to a frozen prototype becomes a silent no-op in sloppy mode or a `TypeError` in strict mode. Node's `--frozen-intrinsics` flag does this for built-ins automatically.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-48170 since 05/21/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059 for this issue.

Upgrading to version 0.9.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• thomaspoignant

Name

• scim-patch

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9.0

Website

• Product: https://github.com/thomaspoignant/scim-patch/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion