Skip to content
OpenAdvisories

Package · npm

scim-patch

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-48170

    scimPatch vulnerable to prototype pollution via unfiltered keys in patch

    `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set p…

    thomaspoignant scim-patch scim-patch npm