CVE-2026-48170 Details
Description
`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. Version 0.9.1 contains a patch. A workaround is available. Calling `Object.freeze(Object.prototype)` (and the same on `Array.prototype`, `Function.prototype`) at process startup neutralizes this class of bug — assignment to a frozen prototype becomes a silent no-op in sloppy mode or a `TypeError` in strict mode. Node's `--frozen-intrinsics` flag does this for built-ins automatically.
A prototype pollution vulnerability has been identified in the `scim-patch` library, prior to version 0.9.1. The issue arises when applying a SCIM PATCH operation that includes a value object with keys like '__proto__.someProp'. This unfiltered key allows the PATCH operation to modify `Object.prototype`, setting properties that persist across all plain objects in the Node.js process. The vulnerability is exploitable in any service that uses `scimPatch()` with user-controlled JSON, particularly SCIM endpoints that accept PATCH requests from external identity providers.
Users can upgrade to `scim-patch` version 0.9.2 or later, where this vulnerability has been patched. For those unable to upgrade immediately, a temporary mitigation is to freeze the Object, Array, and Function prototypes at the start of the Node process, which prevents modifications to these prototypes. Alternatively, Node's `--frozen-intrinsics` flag can be used, which automatically applies this freeze to built-in objects.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-9m6g-wc8r-q59c | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/thomaspoignant/scim-patch/commit/260f9cd2ac5ceac3976978850bb47dcb391720f6 | [email protected] | Source CodeVendor |
| https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-9m6g-wc8r-q59c | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| scim-patch | <= 0.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |