Description
Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects
scim-patch blocks direct dangerous path segments such as __proto__, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths.
An attacker who controls a SCIM PATCH operation can use paths such as toString.polluted to mutate shared built-in function objects, for example Object.prototype.toString.
Recommendation
Update the scim-patch package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.9.2
- Patched version(s): 0.9.2
References
Could your website be exposed too?
SmartScanner can check your website for scim-patch: Mutation of Inherited Built-in Method Objects and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Meth - CVE-2026-101902
- scimPatch vulnerable to prototype pollution via unfiltered keys in patch - CVE-2026-48170
- Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection - CVE-2026-101905
- deepmerge mergeObject() allows prototype poisoning of returned objects - CVE-2026-93753
You might also like:
See something that needs correcting? Let us knowUpdated September 28, 2026