scimPatch vulnerable to prototype pollution via unfiltered keys in patch

Summary scim-patch performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the Node process. Any service that calls scimPatch on...

PT-2026-51450

Name of the Vulnerable Software and Affected Versions scim-patch versions prior to 0.9.1 Description scim-patch is subject to prototype pollution, a condition where an attacker can manipulate the prototype of base object classes. This occurs when the scimPatch function processes a SCIM PATCH...