scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such as toString can therefore traverse into a shared built-in function object and add attacker-controlled properties, causing process-global mutation that may affect application logic reading inherited-method properties. This issue is fixed in version 0.9.2.

Affected: npm: scim-patch

## Summary

Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects

`scim-patch` blocks direct dangerous path segments such as `__proto__`, `constructor`, and `prototype`, but still traverses inherited properties when applying SCIM patch paths.

An attacker who controls a SCIM PATCH operation can use paths such as `toString.polluted` to mutate shared built-in function objects, for example `Object.prototype.toString`.

## Impact

A malicious patch can add attacker-controlled properties to inherited built-in method objects. The impact is narrower than direct `Object.prototype` pollution, but the mutation is process-global and may affect application logic that reads properties from inherited methods.

## Details

Affected code paths:

- `navigate()` reads inherited properties via `schema[subPath]` - `assign()` uses `key in obj`, which treats inherited properties as existing

Because inherited keys are followed, safe-looking path segments such as `toString` can resolve to shared built-in objects.

## PoC

```js const assert = require("node:assert/strict"); const { scimPatch } = require("./lib/src/scimPatch");

const victim = { schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"], userName: "alice", active: true, emails: [{ value: "alice@example.com", primary: true }], meta: { created: "x", lastModified: "x", resourceType: "User" } };

try { assert.equal(({}).toString.scimPatchPolluted, undefined);

scimPatch(victim, [ { op: "…