Ridingsa

**Name of the Vulnerable Software and Affected Versions** piscina versions prior to 6.0.0-rc.2 piscina versions prior to 5.2.0 piscina versions prior to 4.9.3 **Description** Prototype pollution in the constructor and `run()` paths allows an attacker to control the filename option. When the options object lacks a `filename` property, the application reads it from the prototype chain. If `Object.prototype.filename` is polluted, the inherited value is passed to the `worker threads.Worker` import, enabling the execution of an attacker-controlled `.mjs` file within the worker. **Recommendations** Update to version 6.0.0-rc.2. Update to version 5.2.0. Update to version 4.9.3.