CVE-2026-61834: scim-patch: Mutation of Inherited Built-in Method Objects
scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such as toString can therefore traverse into a shared built-in function object and add attacker-controlled properties, causing process-global mutation that may affect application logic reading inherited-method properties. This issue is fixed in version 0.9.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
scim-patchto a version that resolves this vulnerability.Fixed in 0.9.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using npm/scim-patch versions earlier than 0.9.2 are exposed when they apply SCIM PATCH operations containing attacker-controlled paths or dotted value keys.
What access does an attacker need?
The supplied severity vector indicates network reachability, low privileges, and no user interaction. Exploitation relies on the attacker being able to submit SCIM PATCH data that the application passes to the library.
What can exploitation affect?
An attacker can add properties to a shared built-in function object through inherited properties such as toString. The resulting process-global mutation may alter application logic that reads inherited-method properties.