Description
scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such as toString can therefore traverse into a shared built-in function object and add attacker-controlled properties, causing process-global mutation that may affect application logic reading inherited-method properties. This issue is fixed in version 0.9.2.
Published: 2026-09-23
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: Application logic compromise
Action: Patch
AI Analysis

Impact

The vulnerability lies in scim-patch’s handling of SCIM PATCH operations, where navigating and assigning paths that begin with an inherited property such as toString can mutate a shared built‑in function object. This mutation occurs globally within the process, potentially altering application behavior when it later reads inherited‑method properties.

Affected Systems

Affected vendors include thomaspoignant’s scim-patch library. Any installation of scim-patch older than version 0.9.2 is vulnerable. The fix is released in v0.9.2.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in KEV. Based on the description, it is inferred that an attacker who can supply untrusted SCIM PATCH requests to an application using the library could trigger the mutation; as a result, the risk applies to environments that expose SCIM PATCH to external actors. Though the impact is limited to global state change rather than direct code execution, it can enable subtle logic errors or denial of service.

Generated by OpenCVE AI on September 23, 2026 at 16:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade scim-patch to version 0.9.2 or later.
  • Implement validation that rejects SCIM PATCH paths that start with inherited property names such as "toString".
  • Review application code to ensure no unchecked use of scim-patch on external input, and enable logging of any global mutations.

Generated by OpenCVE AI on September 23, 2026 at 16:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Thomaspoignant
Thomaspoignant scim-patch
Vendors & Products Thomaspoignant
Thomaspoignant scim-patch

Wed, 23 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such as toString can therefore traverse into a shared built-in function object and add attacker-controlled properties, causing process-global mutation that may affect application logic reading inherited-method properties. This issue is fixed in version 0.9.2.
Title scim-patch: Mutation of Inherited Built-in Method Objects
Weaknesses CWE-1321
CWE-915
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Thomaspoignant Scim-patch
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-23T16:20:22.098Z

Reserved: 2026-07-10T20:28:17.511Z

Link: CVE-2026-61834

cve-icon Vulnrichment

Updated: 2026-09-23T16:20:17.949Z

cve-icon NVD

Status : Deferred

Published: 2026-09-23T15:17:15.127

Modified: 2026-09-23T17:17:15.923

Link: CVE-2026-61834

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T16:15:06Z

Weaknesses
  • CWE-1321

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  • CWE-915

    Improperly Controlled Modification of Dynamically-Determined Object Attributes