2vulnerabilities
- Critical1 (50.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (50.0%)
- Low0 (0.0%)
scim-patch
Ecosystem: npm
Downloads: 967.4 K
- 1CriticalAffects 1 version
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting scim-patch, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-2mhw-wcx5-v3xj | Moderate | scim-patch: Mutation of Inherited Built-in Method Objects## Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects `scim-patch` blocks direct dangerous path segments such as `__proto__`, `constructor`, and `prototype`, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATCH operation can use paths such as `toString.polluted` to mutate shared built-in function objects, for example `Object.prototype.toString`. ## Impact A malicious patch can add attacker-controlled properties to inherited built-in method objects. The impact is narrower than direct `Obj |
| GitHub (opens in a new tab) | |
| GHSA-9m6g-wc8r-q59c | Critical | scimPatch vulnerable to prototype pollution via unfiltered keys in patch## Summary `scim-patch` performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. ## Impact - **Class:** Prototype pollution ([CWE-1321](https://cwe.mitre.org/data/definitions/1321.html)) - **Affected versions:** `<= 0.9.0` (current |
| GitHub (opens in a new tab) |
- GHSA-2mhw-wcx5-v3xjModeratescim-patch: Mutation of Inherited Built-in Method Objects
< 0.9.2
## Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects `scim-patch` blocks direct dangerous path segments such as `__proto__`, `constructor`, and `prototype`, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATCH operation can use paths such as `toString.polluted` to mutate shared built-in function objects, for example `Object.prototype.toString`. ## Impact A malicious patch can add attacker-controlled properties to inherited built-in method objects. The impact is narrower than direct `Obj
CVE: CVE-2026-61834
- GHSA-9m6g-wc8r-q59cCriticalscimPatch vulnerable to prototype pollution via unfiltered keys in patch
< 0.9.1
## Summary `scim-patch` performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. ## Impact - **Class:** Prototype pollution ([CWE-1321](https://cwe.mitre.org/data/definitions/1321.html)) - **Affected versions:** `<= 0.9.0` (current
CVE: CVE-2026-48170