CVE-2026-61834

scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...

EUVD-2026-85327

scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...

CVE-2026-61834

The scim-patch library, used for applying SCIM patch operations, is vulnerable to process-global mutation in versions prior to 0.9.2 . The root cause lies in the navigate() function reading inherited properties and the assign() function using prototype-chain membership checks when resolving attac...

CVE-2026-61834 scim-patch: Mutation of Inherited Built-in Method Objects

scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...

CVE-2026-61834 scim-patch: Mutation of Inherited Built-in Method Objects

scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...

CVE-2026-48170

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

CVE-2026-48170

The CVE-2026-48170 issue affects the scim-patch library (SCIM PATCH processing). Before version 0.9.1, PATCH operations with a value object containing keys like proto .someProp can pollute Object.prototype, affecting all plain objects in the Node process. This can enable prototype pollution with ...

CVE-2026-48170 scimPatch vulnerable to prototype pollution via unfiltered keys in patch

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

EUVD-2026-54686

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

CVE-2026-48170

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

CVE-2026-48170: Improperly Controlled Modification of Object Prototype Attributes

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

@budibase/backend-core (>=0.0.999-alpha.30, <=3.2.26), @budibase/bbui (>=0.0.999-alpha.30, <=3.2.26) +9 more potentially affected by CVE-2026-48170 via scim-patch (>=0.7.1, <=0.8.3)

scim-patch NPM version =0.7.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =1.0.11, =1.2.1 Source cves: CVE-2026-48170 Source advisory: SNYK:JS-SCIMPATCH-17818138...

@budibase/backend-core (>=0.0.999-alpha.30, <=3.2.26), @budibase/bbui (>=0.0.999-alpha.30, <=3.2.26) +9 more potentially affected by CVE-2026-48170 via scim-patch (>=0.7.1, <=0.8.3)

scim-patch NPM version =0.7.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =1.0.11, =1.2.1 Source cves: CVE-2026-48170 Source advisory: OSV:GHSA-9M6G-WC8R-Q59C...

Prototype Pollution

Overview scim-patch is a SCIM Patch operation rfc7644. Affected versions of this package are vulnerable to Prototype Pollution via the scimPatch function. An attacker can modify the Object.prototype by supplying specially crafted keys in a patch operation, which can lead to privilege escalation,...

scimPatch vulnerable to prototype pollution via unfiltered keys in patch

Summary scim-patch performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the Node process. Any service that calls scimPatch on...

PT-2026-51450

Summary scim-patch performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like " proto .someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the Node process. Any service that calls scimPatch o...