CVE-2026-48170 thomaspoignant CVE debrief

Who should care

Defenders of services that use the `scim-patch` library, especially those exposed to external Identity Providers (IdPs), should assess their exposure and prioritize updating to version 0.9.1 or applying the recommended workaround.

Why it matters

CVE-2026-48170 is a critical vulnerability in the `scim-patch` library that allows for prototype pollution, affecting services that call `scimPatch()` on attacker-controlled JSON. Defenders should prioritize updating to version 0.9.1 or applying a workaround to prevent potential elevation of privileges or data tampering.

• Modification of Object.prototype process-wide, affecting every plain object in the Node process
• Potential for elevation of privileges or data tampering
• Need for immediate patching or mitigation to prevent exploitation
• Verification of affected services and inventory checks for exposure

Technical summary

The `scim-patch` library prior to version 0.9.1 is vulnerable to prototype pollution. When applying a SCIM PATCH operation with a `value` object containing a key like `__proto__.someProp`, it sets `Object.prototype.someProp` process-wide. This affects every plain object in the Node process. The issue is addressed in version 0.9.1. A workaround involves freezing object prototypes at process startup.

Defensive priority

High priority should be given to updating the `scim-patch` library to version 0.9.1 or applying the recommended workaround, especially for services exposed to external IdPs.

Recommended defensive actions

• Update the `scim-patch` library to version 0.9.1 or later
• Apply the workaround by calling `Object.freeze(Object.prototype)` at process startup
• Review and update services that call `scimPatch()` on attacker-controlled JSON
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the available patch. The vulnerability is considered critical with a CVSS score of 9.1. Evidence from the CVE Program and NVD detail page confirms that the `scim-patch` library prior to version 0.9.1 is vulnerable to prototype pollution. Defenders should verify affected services, review inventory for exposure, and assess potential elevation of privileges or data tampering risks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.