PT-2026-103583 · Npm · Piscina
CVSS v4.0
9.2
حرجة
| المتجه | AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
piscina versions prior to 4.9.4
piscina versions prior to 5.3.2
piscina versions prior to 6.0.0-rc.5
Description
This issue occurs because the software stores
ThreadPool.options as a plain object that inherits from Object.prototype. When a separate prototype pollution primitive is present, an attacker can supply inherited values for security-sensitive options that lack their own defaults. This can lead to the following impacts:- An inherited
execArgvvalue passed to the Node.js Worker constructor may preload attacker-controlled code in worker threads. - An inherited
loadBalancerfunction may execute during task scheduling. - Inherited
envvalues may alter worker environments.
Recommendations
Update to version 4.9.4.
Update to version 5.3.2.
Update to version 6.0.0-rc.5.
استغلال
إصلاح
Prototype Pollution
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Piscina