https://vulnerability.circl.lu/sightings/feed 2026-09-28T23:22:15.071567+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/10246046-32b6-4507-bd3f-33a9315ca4ac/export 2026-09-28T23:22:15.101201+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "10246046-32b6-4507-bd3f-33a9315ca4ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61834", "type": "seen", "source": "https://gist.github.com/alon710/1e6966b3bf29b17f610a3994611f58db", "content": "# CVE-2026-61834: CVE-2026-61834: Prototype Pollution and Mutation of Inherited Built-in Method Objects in scim-patch\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61834\n\n## Summary\nA vulnerability in the scim-patch library allows authenticated users to pollute the global JavaScript execution environment. By transmitting a SCIM PATCH operation targeting inherited built-in methods, such as toString, valueOf, or hasOwnProperty, attackers bypass blocklist filters and mutate global prototype objects. This flaw occurs due to the library relying on standard prototype lookup and the 'in' operator during path-resolution and assignment, resolving to shared native functions instead of treating them as missing own-properties.\n\n## TL;DR\nThe scim-patch library fails to restrict traversal through inherited properties during SCIM PATCH operations. Authenticated attackers can use dotted paths or implicit key resolution to access and mutate global built-in methods, leading to prototype pollution and application instability.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-915 / CWE-1321\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.3 (Medium)\n- **EPSS Score**: 0.0028 (0.28%)\n- **Impact**: Process-Global Attribute Mutation\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- scim-patch NPM Package\n- **scim-patch**: < 0.9.2 (Fixed in: `0.9.2`)\n\n## Mitigation\n\n- Upgrade scim-patch dependency to version 0.9.2 or above.\n- Implement Web Application Firewall rules to block payloads containing dot-notated built-in methods in the path parameter.\n- Freeze the prototypes of standard built-in objects at runtime startup.\n\n**Remediation Steps:**\n1. Identify vulnerable installations of scim-patch using npm list scim-patch or yarn why scim-patch.\n2. Update package.json to point to scim-patch version ^0.9.2.\n3. Run npm install or yarn install to apply the dependency update.\n4. Verify the fix by running integration tests with custom payloads targeting toString, valueOf, and hasOwnProperty.\n\n## References\n\n- [GitHub Security Advisory GHSA-2mhw-wcx5-v3xj](https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-2mhw-wcx5-v3xj)\n- [GitHub Pull Request #1127](https://github.com/thomaspoignant/scim-patch/pull/1127)\n- [GitHub Commit c86474f](https://github.com/thomaspoignant/scim-patch/commit/c86474f7a9b16191d939f59ba94eca6c6e63044b)\n- [Release v0.9.2](https://github.com/thomaspoignant/scim-patch/releases/tag/v0.9.2)\n- [National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2026-61834)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-61834)\n- [Shodan Vulnerability Details](https://www.shodan.io/search?query=CVE-2026-61834)\n- [MITRE ATT&CK Mapping Portal](https://attack.mitre.org/search/?search=CVE-2026-61834)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61834) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-28T15:30:31.000000Z"} 2026-09-28T15:30:31+00:00 https://vulnerability.circl.lu/sighting/9479c88a-29b2-4be0-a1bc-8d46f108741d/export 2026-09-28T23:22:15.103061+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "9479c88a-29b2-4be0-a1bc-8d46f108741d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-61834", "type": "published-proof-of-concept", "source": "https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-2mhw-wcx5-v3xj", "content": "", "creation_timestamp": "2026-06-24T17:13:03.000000Z"} 2026-06-24T17:13:03+00:00