SCIM Patch Library Vulnerability in Thomas Poignant Products

CVE-2026-61834

What is CVE-2026-61834?

The SCIM Patch library prior to version 0.9.2 contains a vulnerability that allows exploitation via inherited properties. The navigate() function retrieves inherited properties, while the assign() function erroneously checks for prototype-chain membership when resolving SCIM PATCH paths. This oversight enables paths or value keys that begin with inherited properties, such as toString, to access shared built-in function objects, ultimately permitting the addition of attacker-controlled properties. Such unauthorized modifications could lead to unexpected behavior in applications that rely on inherited-method properties. Users are advised to update to version 0.9.2 to mitigate this risk.

References