Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. Version 0.9.1 contains a patch. A workaround is available. Calling `Object.freeze(Object.prototype)` (and the same on `Array.prototype`, `Function.prototype`) at process startup neutralizes this class of bug — assignment to a frozen prototype becomes a silent no-op in sloppy mode or a `TypeError` in strict mode. Node's `--frozen-intrinsics` flag does this for built-ins automatically.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-23 | 1 | Patch1 |
| 2026-07-28 | 1 | Disclosure1 |
| 2026-08-08 | 2 | Disclosure2 |
| 2026-08-09 | 1 | Disclosure1 |
| 2026-08-10 | 1 | Disclosure1 |
| 2026-10-01 | 1 | Disclosure1 |
| 2026-10-02 | 1 | Disclosure1 |
CVE-2026-48170: scim-patch Prototype Pollution Vulnerability - What It Means for Your Business and How to Respond https://hubs.li/Q04z0M6X0
Post summary
The text announces CVE-2026-48170, a Prototype Pollution vulnerability in scim-patch, focusing on its implications for businesses without mentioning PoCs, exploits, patches, or active exploitation.
CVE-2026-48170: scim-patch Prototype Pollution Vulnerability - What It Means for Your Business and How to Respond https://hubs.li/Q04yZgzl0
Post summary
The tweet announces CVE-2026-48170 as a prototype pollution vulnerability affecting scim-patch, outlining its business impact and recommended response.
CVE-2026-48170 - Critical prototype pollution in scim-patch <0.9.1. Attacker-controlled SCIM PATCH can pollute Object.prototype process-wide. CVSS 9.1. Unpatched - update immediately. #CVE #NodeJS #infosec https://www.valtersit.com/cve/CVE-2026-48170 #infosec #cybersecurity #CVE #Linux #infosec #infosec #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu
Post summary
This tweet announces CVE‑2026‑48170, a critical prototype‑pollution flaw in scim‑patch versions below 0.9.1 that can pollute Object.prototype process‑wide. The vulnerability carries a CVSS score of 9.1 and remains unpatched, urging immediate update.
🔐 SCIM library prototype-pollution vulnerability disclosed CVE-2026-48170 affects scim-patch before 0.9.1. Attacker-controlled SCIM PATCH data containing special prototype keys can modify Object.prototype across a Node.js process, potentially affecting other application objects. ✅ Fixed in 0.9.1. 🔎 Source: GitHub / CVE / VulDB #NodeJS #SCIM #PrototypePollution #CVE #CyberSecurity
Post summary
CVE‑2026‑48170 is a prototype‑pollution flaw in the scim‑patch library (pre‑0.9.1) that permits attackers to modify Object.prototype via crafted SCIM PATCH data, and the issue has been fixed in version 0.9.1.
🚨*CVE* CVE-2026-48170 `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains … https://www.cve.org/CVERecord?id=CVE-2026-48170 ----- Traducción: CVE-2026-48170 `sc… http://infoflow.cloud`
Post summary
The note announces the CVE-2026-48170 prototype‑pollution flaw in scim-patch, gives a short technical description and a link to the CVE record, but shows no exploits, mitigation, or active usage.
CVE-2026-48170 `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains … https://www.cve.org/CVERecord?id=CVE-2026-48170
Post summary
CVE-2026-48170 exposes a prototype pollution flaw in scim-patch library versions prior to 0.9.1 when processing SCIM PATCH operations with a ‘value’ object.
Another reminder that trust is earned, not assumed. CVE-2026-48170. scimPatch vulnerable to prototype pollution via unfiltered keys in patch Build like the next disruption is already in motion — because it is.
Post summary
The tweet announces CVE‑2026‑48170 as a prototype pollution vulnerability in scimPatch caused by unfiltered patch keys, without noting exploitation or remediation.
🚨Critical - scim-patch Prototype Pollution via Unfiltered PATCH Keys (CVE-2026-48170) The scim-patch Node library applies SCIM PATCH operations without filtering dangerous keys. A PATCH whose value object contains a key like "__proto__.someProp" is walked by assign() so that obj["__proto__"] resolves to Object.prototype, and the write lands on the prototype — polluting every plain object in the Node process. Any service that calls scimPatch() on attacker-controlled JSON (any SCIM PATCH /Users/:id endpoint fed by an external IdP) is exploitable on a stock Node runtime. Downstream impact ranges from privilege escalation (e.g. polluting isAdmin) to logic bypass and DoS, persisting until the process restarts. 👉Upgrade to scim-patch 0.9.1.
Post summary
CVE-2026-48170 is a prototype‑pollution flaw in scim-patch that can lead to privilege escalation and DoS; a patch (0.9.1) is available to remediate the issue.