GCVE - cpe:2.3:a:thomaspoignant:scim-patch:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:thomaspoignant:scim-patch:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Thomaspoignant (`bd689be5-66e4-5d93-8ec9-1e7ab6cc7340`)
Product	Scim Patch (`187e634e-66e5-59c2-bb85-2e46b5a3f988`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-48170`	vulnerable	2026-09-16 04:33:04.546621	scimPatch vulnerable to prototype pollution via unfiltered keys in patch CRITICAL (9.1) `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. Version 0.9.1 contains a patch. A workaround is available. Calling `Object.freeze(Object.prototype)` (and the same on `Array.prototype`, `Function.prototype`) at process startup neutralizes this class of bug — assignment to a frozen prototype becomes a silent no-op in sloppy mode or a `TypeError` in strict mode. Node's `--frozen-intrinsics` flag does this for built-ins automatically. Published: 2026-08-07T21:26:54.941Z Updated: 2026-08-10T14:06:00.075Z Open on db.gcve.eu Reference links https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-9m6g-wc8r-q59c https://github.com/thomaspoignant/scim-patch/commit/260f9cd2ac5ceac3976978850bb47dcb391720f6	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.