VulnSocial

CVE-2026-48170Disclosure

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"__proto__.someProp"`. After one such patch, `Object.prototype.someProp` is set process-wide, affecting every plain object in the Node process. Any service that calls `scimPatch()` on attacker-controlled JSON (i.e. any SCIM endpoint accepting `PATCH` from an external IdP) is exploitable on a stock Node runtime. Version 0.9.1 contains a patch. A workaround is available. Calling `Object.freeze(Object.prototype)` (and the same on `Array.prototype`, `Function.prototype`) at process startup neutralizes this class of bug — assignment to a frozen prototype becomes a silent no-op in sloppy mode or a `TypeError` in strict mode. Node's `--frozen-intrinsics` flag does this for built-ins automatically.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-1321

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 6 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 6 signals
  • Disclosure: 5 classified signals
  • Peaked 2d ago at 2 mentions (2026-08-08); latest day: 1
  • 6 total mentions across 5 days

Deep dive

Activity timeline6 mentions / 5d
01122Mentions · 2026-06-23: 1Mentions · 2026-07-28: 1Mentions · 2026-08-08: 2Mentions · 2026-08-09: 1Mentions · 2026-08-10: 1Patch / Workaround · 2026-06-23: 1Patch / Workaround · 2026-08-09: 1Patch / Workaround · 2026-08-10: 1Technical Details · 2026-06-23: 1Technical Details · 2026-07-28: 1Technical Details · 2026-08-08: 2Technical Details · 2026-08-09: 1Technical Details · 2026-08-10: 106-2307-2808-0808-0908-10
Signal classification2 categories
Disclosure
583.3%
Patch
116.7%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-231
Patch1
2026-07-281
Disclosure1
2026-08-082
Disclosure2
2026-08-091
Disclosure1
2026-08-101
Disclosure1
Full discourse6 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    CVE-2026-48170 - Critical prototype pollution in scim-patch <0.9.1. Attacker-controlled SCIM PATCH can pollute Object.prototype process-wide. CVSS 9.1. Unpatched - update immediately. #CVE #NodeJS #infosec https://www.valtersit.com/cve/CVE-2026-48170 #infosec #cybersecurity #CVE #Linux #infosec #infosec #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu

    Post summary

    This tweet announces CVE‑2026‑48170, a critical prototype‑pollution flaw in scim‑patch versions below 0.9.1 that can pollute Object.prototype process‑wide. The vulnerability carries a CVSS score of 9.1 and remains unpatched, urging immediate update.

    0000063
    1.0K followersView on X
  • CyberSignal | Cybersecurity News@XQOPTRX
    Disclosure

    🔐 SCIM library prototype-pollution vulnerability disclosed CVE-2026-48170 affects scim-patch before 0.9.1. Attacker-controlled SCIM PATCH data containing special prototype keys can modify Object.prototype across a Node.js process, potentially affecting other application objects. ✅ Fixed in 0.9.1. 🔎 Source: GitHub / CVE / VulDB #NodeJS #SCIM #PrototypePollution #CVE #CyberSecurity

    Post summary

    CVE‑2026‑48170 is a prototype‑pollution flaw in the scim‑patch library (pre‑0.9.1) that permits attackers to modify Object.prototype via crafted SCIM PATCH data, and the issue has been fixed in version 0.9.1.

    0000043
    34 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-48170 `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains … https://www.cve.org/CVERecord?id=CVE-2026-48170 ----- Traducción: CVE-2026-48170 `sc… http://infoflow.cloud`

    Post summary

    The note announces the CVE-2026-48170 prototype‑pollution flaw in scim-patch, gives a short technical description and a link to the CVE record, but shows no exploits, mitigation, or active usage.

    0000045
    98 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-48170 `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains … https://www.cve.org/CVERecord?id=CVE-2026-48170

    Post summary

    CVE-2026-48170 exposes a prototype pollution flaw in scim-patch library versions prior to 0.9.1 when processing SCIM PATCH operations with a ‘value’ object.

    000001.1K
    57.9K followersView on X
  • Joey Romaine 🇺🇸 |=★=|@Tank23x0
    Disclosure

    Another reminder that trust is earned, not assumed. CVE-2026-48170. scimPatch vulnerable to prototype pollution via unfiltered keys in patch Build like the next disruption is already in motion — because it is.

    Post summary

    The tweet announces CVE‑2026‑48170 as a prototype pollution vulnerability in scimPatch caused by unfiltered patch keys, without noting exploitation or remediation.

    0000022
    334 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨Critical - scim-patch Prototype Pollution via Unfiltered PATCH Keys (CVE-2026-48170) The scim-patch Node library applies SCIM PATCH operations without filtering dangerous keys. A PATCH whose value object contains a key like "__proto__.someProp" is walked by assign() so that obj["__proto__"] resolves to Object.prototype, and the write lands on the prototype — polluting every plain object in the Node process. Any service that calls scimPatch() on attacker-controlled JSON (any SCIM PATCH /Users/:id endpoint fed by an external IdP) is exploitable on a stock Node runtime. Downstream impact ranges from privilege escalation (e.g. polluting isAdmin) to logic bypass and DoS, persisting until the process restarts. 👉Upgrade to scim-patch 0.9.1.

    Post summary

    CVE-2026-48170 is a prototype‑pollution flaw in scim-patch that can lead to privilege escalation and DoS; a patch (0.9.1) is available to remediate the issue.

    0000081
    226 followersView on X

Explore more

Back to dashboard