Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATCH operation can use paths such as toString.polluted to mutate shared built-in function objects, for example Object.prototype.toString. Impact A malicious patch can add attacker-controlled properties to inherited built-in method objects. The impact is narrower than direct Object.prototype pollution, but the mutation is process-global and may affect application logic that reads properties from inherited methods. Details Affected code paths: - navigate() reads inherited properties via schema[subPath] - assign() uses key in obj, which treats inherited properties as existing Because inherited keys are followed, safe-looking path segments such as toString can resolve to shared built-in objects. PoC…
Recommended action: Upgrade to 0.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
scim-patch performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the Node process. Any service that calls scimPatch() on attacker-controlled JSON (i.e. any SCIM endpoint accepting PATCH from an external IdP) is exploitable on a stock Node runtime. Impact - Class: Prototype pollution (CWE-1321) - Affected versions: <= 0.9.0 (current HEAD 871b1e2) - Attack vector: Network — sent as part of a normal SCIM PATCH /Users/:id request body. - Privileges required: Whatever the SCIM endpoint requires. For most integrations that's a provisioned IdP, which is "low" in CVSS terms (any authenticated provisioning client). - Scope: Changed — the bug is in a SCIM library but the side effect (Object.prototype mutation) leaks into the entire Node process. Downstream consequences depend on what other code reads from plain…
Recommended action: Upgrade to 0.9.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.