CVE-2026-102992
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
A prototype-pollution gadget in ThreadPool.options allows an attacker who can pollute Object.prototype to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that ThreadPool.options is created as a plain object inheriting from Object.
- No known exploitation
- Severity
- Critical, CVSS 9.2 (v4.0)
- EPSS
- 0.43% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- piscina (npm) >= 5.0.0, < 5.3.2, fixed in 5.3.2 · GHSA-67c8-pqhq-4rmx
- piscina (npm) < 4.9.4, fixed in 4.9.4 · GHSA-67c8-pqhq-4rmx
- piscina (npm) >= 6.0.0-rc.1, < 6.0.0-rc.5, fixed in 6.0.0-rc.5 · GHSA-67c8-pqhq-4rmx