Skip to content
OpenAdvisories

Package · npm

scim-patch

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 4.3
    CVE-2026-61834

    scim-patch: Mutation of Inherited Built-in Method Objects

    scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys …

    thomaspoignant scim-patch scim-patch npm
  • Critical 9.1
    CVE-2026-48170

    scimPatch vulnerable to prototype pollution via unfiltered keys in patch

    `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set p…

    thomaspoignant scim-patch scim-patch npm