{
  "schemaVersion": 1,
  "site": "https://cveboard.org",
  "generatedAt": "2026-10-23T20:16:34.346Z",
  "lastRun": "2026-10-23T20:01:03.754Z",
  "liveDays": 14,
  "filters": {
    "kind": null,
    "exploited": false,
    "severity": null,
    "ecosystems": [],
    "tag": "piscinajs"
  },
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incidents": [
    {
      "id": "cve-2026-102992",
      "url": "https://cveboard.org/i/cve-2026-102992",
      "urlPt": "https://cveboard.org/pt/i/cve-2026-102992",
      "json": "https://cveboard.org/i/cve-2026-102992.json",
      "kind": "vuln",
      "live": false,
      "knownExploited": false,
      "severity": "critical",
      "title": "piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env",
      "summary": "A prototype-pollution gadget in ThreadPool.options allows an attacker who can pollute Object.prototype to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that ThreadPool.options is created as a plain object inheriting from Object.",
      "titlePt": "piscina: gadget de poluição de protótipo em ThreadPool.options permite RCE via execArgv / loadBalancer / env",
      "summaryPt": "Um gadget de poluição de protótipo em ThreadPool.options permite que um atacante que possa poluir Object.prototype execute código arbitrário em threads de trabalho da Piscina, invoque funções arbitrárias durante o agendamento de tarefas ou injete variáveis de ambiente nos trabalhadores. A causa raiz é que ThreadPool.options é criado como um objeto simples herdando de Object.",
      "affected": [],
      "omitted": 0,
      "references": [
        {
          "url": "https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx",
          "tag": "exploit"
        }
      ],
      "cwes": [
        {
          "id": "CWE-1321",
          "name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"
        }
      ],
      "ssvc": {
        "exploitation": "poc",
        "automatable": "no",
        "impact": "total",
        "at": "2026-09-30T20:47:28.974Z"
      },
      "fix": "listed",
      "tags": [
        "piscinajs",
        "npm"
      ],
      "cves": [
        "CVE-2026-102992"
      ],
      "ghsa": "GHSA-67c8-pqhq-4rmx",
      "cvss": {
        "score": 9.2,
        "version": "4.0",
        "by": "GitHub"
      },
      "epss": {
        "percentage": 0.00434,
        "percentile": 0.36698,
        "asOf": "2026-10-23",
        "by": "FIRST"
      },
      "packages": [
        {
          "ecosystem": "npm",
          "name": "piscina",
          "vulnerable": ">= 5.0.0, < 5.3.2",
          "fixed": "5.3.2",
          "advisory": "GHSA-67c8-pqhq-4rmx"
        },
        {
          "ecosystem": "npm",
          "name": "piscina",
          "vulnerable": "< 4.9.4",
          "fixed": "4.9.4",
          "advisory": "GHSA-67c8-pqhq-4rmx"
        },
        {
          "ecosystem": "npm",
          "name": "piscina",
          "vulnerable": ">= 6.0.0-rc.1, < 6.0.0-rc.5",
          "fixed": "6.0.0-rc.5",
          "advisory": "GHSA-67c8-pqhq-4rmx"
        }
      ],
      "vendor": "piscinajs",
      "product": "piscina",
      "kev": null,
      "breach": null,
      "retracted": false,
      "sources": [
        {
          "label": "GitHub Advisory Database",
          "url": "https://github.com/advisories/GHSA-67c8-pqhq-4rmx"
        }
      ],
      "cvePending": true,
      "publishedAt": "2026-10-01T15:03:33.000Z",
      "updatedAt": "2026-10-01T15:03:33.000Z"
    }
  ],
  "tag": {
    "tag": "piscinajs",
    "name": "piscinajs",
    "kev": null
  }
}