CVE-2026-61834

Name of the Vulnerable Software and Affected Versions scim-patch versions prior to 0.9.2

Description The library fails to properly validate SCIM PATCH paths, allowing the navigate() function to read inherited properties and the assign() function to use prototype-chain membership checks. An attacker can use a path or dotted value keys starting with an inherited property, such as toString, to traverse into a shared built-in function object and inject attacker-controlled properties. This leads to process-global mutation, which can compromise application logic that relies on inherited-method properties.

Recommendations Update to version 0.9.2.