Log in Start free

Vulnerability · Published Sep 30, 2026 · Assigned by GitHub_M

CVE-2026-102992piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

Critical 9.2

In plain English

A critical-severity prototype pollution in piscina from piscinajs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)0.5%top 56.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmpiscina5.3.2GHSA-67c8-pqhq-4rmx
npmpiscina4.9.4GHSA-67c8-pqhq-4rmx
npmpiscina6.0.0-rc.5GHSA-67c8-pqhq-4rmx

Affected products (as reported)

VendorProductVersions
piscinajs piscina < 4.9.4>= 5.0.0, < 5.3.2>= 6.0.0-rc.1, < 6.0.0-rc.5

Weakness: CWE-1321 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References