{"vulnerability": "cve-2026-48170", "sightings": [{"uuid": "ae915018-0f84-4ed0-877e-7fda0e077b92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48170", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msjldc4i7t2r", "content": "CVE-2026-48170 - scim-patch\nThe scimPatch library in Node.js versions up to 0.9.0 can be exploited by an attacker to modify system settings and potentially gain unauthorized access or disrupt\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#scimpatch #thomaspoignant #npm #CVE #infosec", "creation_timestamp": "2026-08-07T22:14:04.579036Z"}, {"uuid": "bcc634e2-5dd7-4b2b-aaca-7f9ed0dc1f66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48170", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/i3wvb2yauzyfz", "content": "CVE-2026-48170 - scimPatch vulnerable to prototype pollution via unfiltered keys in patch\nCVE ID : CVE-2026-48170\n \n Published : Aug. 7, 2026, 9:26 p.m. | 57\u00a0minutes ago\n \n Description : `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype p...", "creation_timestamp": "2026-08-07T22:48:08.852132Z"}, {"uuid": "a03b30c0-66cc-477c-8dcd-e63635c833b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48170", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msjnwacjmj25", "content": "\ud83d\udd34 CVE-2026-48170 - Critical (9.1)\n\n`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollutio...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-48170/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-07T23:00:28.498394Z"}, {"uuid": "b7fbc5e3-bc88-4139-bd88-0117f48499eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48170", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117056945353010722", "content": "CVE-2026-48170 (CRITICAL, CVSS 9.1): Prototype pollution in scim-patch <0.9.1 lets attackers alter Object.prototype globally in Node.js. Upgrade to 0.9.1+ or freeze prototypes for mitigation. https://radar.offseq.com/threat/cve-2026-48170-cwe-1321-improperly-controlled-modification-of-object-prototype-attributes-prototype-1a8d5ec623a7b014 #OffSeq #CVE202648170 #NodeJS #InfoSec", "creation_timestamp": "2026-08-08T00:00:38.293650Z"}, {"uuid": "516b02c1-ce7c-4477-8623-ccb3ced463f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48170", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msjrbv2itj24", "content": "CRITICAL: Prototype pollution in scim-patch <0.9.1 risks privilege escalation in Node.js. Patch by upgrading to 0.9.1+ or freeze core prototypes at startup. https://radar.offseq.com/threat/cve-2026-48170-cwe-1321-improperly-controlled-modification-of-object-prototype-attributes-prototype-1a8d5ec6...", "creation_timestamp": "2026-08-08T00:00:40.929793Z"}, {"uuid": "8178ccbf-b407-4ae3-85a6-bca8eb1d2661", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48170", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3msnhfuth6w2z", "content": "CVE-2026-48170 - Critical prototype pollution in scim-patch <0.9.1. Attacker-controlled SCIM PATCH can pollute Object.prototype process-wide. CVSS 9.1. Unpatched - update immediately. #CVE #NodeJS #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-48170/", "creation_timestamp": "2026-08-09T11:14:35.429350Z"}, {"uuid": "3a984043-2e7d-4846-9a56-d9109b8f2de7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48170", "type": "published-proof-of-concept", "source": "https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-9m6g-wc8r-q59c", "content": "", "creation_timestamp": "2026-05-21T13:04:48.000000Z"}, {"uuid": "da4debd7-723f-4a9e-b198-8d99b313b7f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48170", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mowbt3vgh62r", "content": "\u26a0\ufe0f PATCH NOW\n\nOne account-sync message can corrupt every object in your app.\n\nA widely-used identity library, scim-patch, applies the update straight onto JavaScript's shared prototype, and admin checks can flip true.\n\nPatch to 0.9.1 now. (CVE-2026-48170)", "creation_timestamp": "2026-06-23T01:47:50.618705Z"}]}