{
  "schemaVersion": 1,
  "incident": {
    "id": "cve-2026-102992",
    "url": "https://cveboard.org/i/cve-2026-102992",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-102992",
    "json": "https://cveboard.org/i/cve-2026-102992.json",
    "kind": "vuln",
    "live": false,
    "knownExploited": false,
    "severity": "critical",
    "title": "piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env",
    "summary": "A prototype-pollution gadget in ThreadPool.options allows an attacker who can pollute Object.prototype to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that ThreadPool.options is created as a plain object inheriting from Object.",
    "titlePt": "piscina: gadget de poluição de protótipo em ThreadPool.options permite RCE via execArgv / loadBalancer / env",
    "summaryPt": "Um gadget de poluição de protótipo em ThreadPool.options permite que um atacante que possa poluir Object.prototype execute código arbitrário em threads de trabalho da Piscina, invoque funções arbitrárias durante o agendamento de tarefas ou injete variáveis de ambiente nos trabalhadores. A causa raiz é que ThreadPool.options é criado como um objeto simples herdando de Object.",
    "cves": [
      "CVE-2026-102992"
    ],
    "ghsa": "GHSA-67c8-pqhq-4rmx",
    "cvss": {
      "score": 9.2,
      "version": "4.0"
    },
    "epss": {
      "percentage": 0.00434,
      "percentile": 0.36625,
      "asOf": "2026-10-23"
    },
    "packages": [
      {
        "ecosystem": "npm",
        "name": "piscina",
        "vulnerable": ">= 5.0.0, < 5.3.2",
        "fixed": "5.3.2",
        "advisory": "GHSA-67c8-pqhq-4rmx"
      },
      {
        "ecosystem": "npm",
        "name": "piscina",
        "vulnerable": "< 4.9.4",
        "fixed": "4.9.4",
        "advisory": "GHSA-67c8-pqhq-4rmx"
      },
      {
        "ecosystem": "npm",
        "name": "piscina",
        "vulnerable": ">= 6.0.0-rc.1, < 6.0.0-rc.5",
        "fixed": "6.0.0-rc.5",
        "advisory": "GHSA-67c8-pqhq-4rmx"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-67c8-pqhq-4rmx"
      }
    ],
    "publishedAt": "2026-10-01T15:03:33.000Z",
    "updatedAt": "2026-10-01T15:03:33.000Z"
  },
  "live": false,
  "events": [
    {
      "id": "ghsa:GHSA-67c8-pqhq-4rmx:ghsa_published:2026-10-01T15:03:33.000Z",
      "incidentId": "cve-2026-102992",
      "type": "ghsa_published",
      "at": "2026-10-01T15:03:33.000Z",
      "detail": {
        "ghsa": "GHSA-67c8-pqhq-4rmx",
        "severity": "critical",
        "fixed": "5.3.2, 4.9.4, 6.0.0-rc.5"
      }
    }
  ]
}