CVE-2026-48170: 
JavaScript vulnerability analysis and mitigation

CVE-2026-48170 is a prototype pollution vulnerability in the scim-patch npm library (CWE-1321) that allows authenticated network attackers to inject arbitrary properties into Object.prototype process-wide by sending a crafted SCIM PATCH request. All versions up to and including 0.9.0 are affected; the patched version is 0.9.1/0.9.2. The vulnerability was discovered by Lee Wang (Notion) and reported by David Wu (Notion), first published May 21, 2026, and added to the GitHub Advisory Database on June 22, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, scim-patch Advisory).

The root cause is in src/scimPatch.ts within the addOrReplaceObjectAttribute function (lines 415–427), which iterates user-supplied patch.value keys via Object.entries and passes them to resolvePaths, which splits on . without sanitizing dangerous segments. The resulting key path is then walked by the assign function with no filtering, so a key like __proto__ causes obj = obj["__proto__"] to resolve to Object.prototype, and the final write lands on Object.prototype itself. The same attack shape works with constructor.prototype keys. Exploitation requires only the ability to send a SCIM PATCH request body — typically available to any provisioned Identity Provider (IdP) client — making the attack vector network-accessible with low privilege requirements and no user interaction (GitHub Advisory, scim-patch Advisory, Fix Commit).

Successful exploitation mutates Object.prototype process-wide for the lifetime of the Node.js process, affecting every plain object in the runtime — not just SCIM-related objects. Realistic consequences include privilege escalation (e.g., setting Object.prototype.isAdmin = true causes any middleware checking actor.isAdmin on a plain object to grant admin access), logic bypass, and denial of service if code branches on properties expected to be absent. The pollution persists until the Node process restarts, meaning every subsequent request handled by that container is affected, significantly expanding the blast radius beyond the initial SCIM endpoint (GitHub Advisory, scim-patch Advisory).

No public proof-of-concept exploit code has been released beyond the test case included in the advisory itself, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The CVE status is currently "Reserved" and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires only low privileges (a provisioned IdP credential), no user interaction, and low attack complexity, making it straightforward to exploit once an attacker has access to a SCIM endpoint. Detection coverage is available via Qualys (detection ID 5014531) and Tenable cloud security plugins.

1. Identify target: Locate a service exposing a SCIM PATCH endpoint (e.g., PATCH /Users/:id) that uses the scim-patch npm library at version ≤ 0.9.0 and accepts requests from an external IdP or provisioning client.
2. Obtain credentials: Acquire valid IdP or provisioning client credentials (low-privilege authenticated access is sufficient for most SCIM integrations).
3. Craft malicious PATCH request: Construct a SCIM PATCH request body with a value object containing a prototype-polluting key, for example:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [{
    "op": "add",
    "path": "name",
    "value": { "__proto__.isAdmin": true }
  }]
}

4. Send the request: Submit the crafted PATCH request to the target endpoint. The scimPatch() function processes the value keys without sanitization, causing Object.prototype.isAdmin to be set to true process-wide.
5. Exploit the polluted prototype: Make subsequent requests to the application. Any middleware or authorization code that checks req.user.isAdmin or similar boolean flags on plain objects will now evaluate to true for all users, granting unauthorized privilege escalation.
6. Maintain persistence: The pollution persists until the Node.js process restarts; no further action is needed to maintain the elevated state for subsequent requests (GitHub Advisory, scim-patch Advisory).

• Network: Inbound SCIM PATCH requests to /Users/:id or similar endpoints with value objects containing keys matching patterns like __proto__.*, constructor.prototype.*, or prototype.* in the JSON body.
• Logs: Application or web server access logs showing PATCH requests to SCIM endpoints with unusually structured JSON payloads; Node.js error logs showing unexpected InvalidScimPatchOp exceptions (post-patch) or, on unpatched versions, no errors despite malformed keys.
• Process Behavior: Unexpected privilege escalation for authenticated users (e.g., non-admin users gaining admin access) without corresponding changes in the identity store; unusual authorization decisions in application logs following a SCIM PATCH operation.
• Runtime State: If runtime inspection is possible, Object.prototype having unexpected enumerable properties (e.g., isAdmin, polluted, or other injected keys) detectable via Object.getOwnPropertyNames(Object.prototype) in a Node.js REPL or debug session (GitHub Advisory).

Upgrade scim-patch to version 0.9.1 or 0.9.2 (patched versions), which rejects keys containing __proto__, constructor, or prototype in resolvePaths — the single chokepoint shared by all vulnerable code paths — throwing an InvalidScimPatchOp error (Fix Commit). For services that cannot upgrade immediately, two workarounds are available: (1) validate and sanitize SCIM PATCH request payloads at the API gateway or middleware layer to reject any keys containing __proto__, constructor, or prototype before they reach scimPatch(); or (2) call Object.freeze(Object.prototype) (and Array.prototype, Function.prototype) at Node.js process startup, or launch Node with the --frozen-intrinsics flag, which converts prototype pollution writes into silent no-ops (sloppy mode) or TypeErrors (strict mode) (GitHub Advisory, scim-patch Advisory).

The vulnerability was discovered internally at Notion by Lee Wang and reported by David Wu, with the advisory report authored with the assistance of Claude (Anthropic's AI). The fix was co-authored with Gemini Code Assist. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time (GitHub Advisory, scim-patch Advisory).