{"action":"Upgrade scim-patch to 0.9.1 or later.","affected":[{"fixed":"0.9.1","introduced":"0"}],"component":"scim-patch","cve_ids":["CVE-2026-48170"],"ecosystem":"npm","epss":0.00403,"exploited":false,"fixed_versions":["0.9.1"],"ghsa_id":"GHSA-9m6g-wc8r-q59c","id":"tcs_01M5KFG6797A93H0BBQQVB4QAE","modified_at":"2026-06-22T23:11:28.954476Z","published_at":"2026-06-22T22:57:48Z","references":["https://osv.dev/vulnerability/GHSA-9m6g-wc8r-q59c","https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-9m6g-wc8r-q59c","https://github.com/thomaspoignant/scim-patch/commit/260f9cd2ac5ceac3976978850bb47dcb391720f6","https://github.com/thomaspoignant/scim-patch"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-9m6g-wc8r-q59c","url":"https://osv.dev/vulnerability/GHSA-9m6g-wc8r-q59c"}],"summary":"scimPatch vulnerable to prototype pollution via unfiltered keys in patch"}