Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-48170: scimPatch allows attackers to modify system settings
CVE-2026-48170 · published 27 days ago
Summary
The scimPatch library in Node.js versions up to 0.9.0 can be exploited by an attacker to modify system settings and potentially gain unauthorized access or disrupt system functionality. This vulnerability affects any service that uses scimPatch to process SCIM PATCH requests from external sources. To protect against this vulnerability, update scimPatch to the latest version.
What to do
- Update thomaspoignant scim-patch to version 0.9.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | thomaspoignant | scim-patch |
<= 0.9.0 Fix: upgrade to 0.9.1
|
| – | thomaspoignant | scim-patch | < 0.9.1 |
Original advisory text
scimPatch vulnerable to prototype pollution via unfiltered keys in patch
`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch,
`Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. Version 0.9.1 contains a patch. A workaround is available. Calling `Object.freeze(Object.prototype)` (and the same on `Array.prototype`, `Function.prototype`) at process startup neutralizes this class of bug — assignment to a frozen prototype becomes a silent no-op in sloppy mode or a `TypeError` in strict mode. Node's `--frozen-intrinsics` flag does this for built-ins automatically.
`Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. Version 0.9.1 contains a patch. A workaround is available. Calling `Object.freeze(Object.prototype)` (and the same on `Array.prototype`, `Function.prototype`) at process startup neutralizes this class of bug — assignment to a frozen prototype becomes a silent no-op in sloppy mode or a `TypeError` in strict mode. Node's `--frozen-intrinsics` flag does this for built-ins automatically.
References
- https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-9m6g-wc8r-...
- https://github.com/thomaspoignant/scim-patch/commit/260f9cd2ac5ceac3976978850bb4...
- https://github.com/advisories/GHSA-9m6g-wc8r-q59c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48170... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-48170 Vendor Advisory
Severity
9.1
Critical
CVSS 3.1: 9.1 (GHSA)
Exploitation
EPSS <1%
Type
CWE-1321Prototype Pollution
Timeline
Published7 Aug 2026
Updated30 Aug 2026
First seen22 Jun 2026
Monitor software like this
Free during beta