Scim Patch
Monthly
Prototype pollution in the scim-patch SCIM PATCH library (all versions before 0.9.2) lets an authenticated caller who can submit SCIM PATCH operations - remote reachable, no user interaction, consistent with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - write attacker-controlled properties onto shared built-in function objects such as Object.prototype.toString by supplying a path or dotted value key that begins with an inherited property name. Impact is modest and integrity-only (CVSS 4.3): the mutation is process-global and may influence application logic that reads inherited-method properties, but meaningful harm requires the consuming application to later consult the polluted property in a security-relevant code path; otherwise the write is largely inert. No public exploit identified at time of analysis, although the upstream fix PR and its regression tests publicly document the exact triggering path patterns, and this issue is not confirmed actively exploited (CISA KEV).
Prototype pollution in the scim-patch SCIM PATCH library (all versions before 0.9.2) lets an authenticated caller who can submit SCIM PATCH operations - remote reachable, no user interaction, consistent with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - write attacker-controlled properties onto shared built-in function objects such as Object.prototype.toString by supplying a path or dotted value key that begins with an inherited property name. Impact is modest and integrity-only (CVSS 4.3): the mutation is process-global and may influence application logic that reads inherited-method properties, but meaningful harm requires the consuming application to later consult the polluted property in a security-relevant code path; otherwise the write is largely inert. No public exploit identified at time of analysis, although the upstream fix PR and its regression tests publicly document the exact triggering path patterns, and this issue is not confirmed actively exploited (CISA KEV).