PT-2026-103583

CVE-2026-102992

Published

2026-08-28

Updated

2026-10-14

Description by

CVSS 4.0

9.2

Critical

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions piscina versions prior to 4.9.4 piscina versions prior to 5.3.2 piscina versions prior to 6.0.0-rc.5

Description This issue occurs because the software stores ThreadPool.options as a plain object that inherits from Object.prototype. When a separate prototype pollution primitive is present, an attacker can supply inherited values for security-sensitive options that lack their own defaults. This can lead to the following impacts:

An inherited execArgv value passed to the Node.js Worker constructor may preload attacker-controlled code in worker threads.
An inherited loadBalancer function may execute during task scheduling.
Inherited env values may alter worker environments.

Recommendations Update to version 4.9.4. Update to version 5.3.2. Update to version 6.0.0-rc.5.

Exploitability

Exploit

Fix

Impacts

Researchers

Fcmam5

Vendors

Affected products

Weakness enumeration

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

Related identifiers