piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
### Summary A prototype-pollution gadget in `ThreadPool.options` allows an attacker who can pollute `Object.prototype` to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that `ThreadPool.options` is created as a plain object inheriting from `Object.prototype`, so any option without an explicit default in `kDefaultOptions` can be supplied via the prototype chain. ### Details In `src/index.ts` the `ThreadPool` constructor builds the resolved options object as a plain object: ```ts this.options = { ...kDefaultOptions, ...options, filename, maxQueue: 0 } ``` Because this object has `Object.prototype` as its prototype, reads for properties that are not own properties of the object and are not present in `kDefaultOptions` fall back to `Object.prototype`. This means a prototype-pollution primitive (e.g. from a vulnerable `merge()` or `JSON.parse` merge elsewhere in the application) can inject values for `execArgv`, `env`, `loadBalancer`, `argv`, `workerData`, `resourceLimits`, `niceIncrement`, `closeTimeout`, `recordTiming`, `stricterFIFO`, `workerHistogram`, and `trackUnmanagedFds`. The most serious gadget is `execArgv`, which is passed directly to `new Worker(..., { execArgv })`. An attacker can set `Object.prototype.execArgv = ['--require', '/tmp/attacker.js']`, causing every worker to preload and execute the attacker-controlled module on startup. This issue surviv
GHSA-67c8-pqhq-4rmx
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-67c8-pqhq-4rmx
piscina
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 5.3.2
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
piscina
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 4.9.4
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
piscina
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 6.0.0-rc.5
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.3.2"
}
]
}
],
"package": {
"name": "piscina",
"purl": "pkg:npm/piscina",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-67c8-pqhq-4rmx/GHSA-67c8-pqhq-4rmx.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.9.4"
}
]
}
],
"package": {
"name": "piscina",
"purl": "pkg:npm/piscina",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-67c8-pqhq-4rmx/GHSA-67c8-pqhq-4rmx.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "6.0.0-rc.1"
},
{
"fixed": "6.0.0-rc.5"
}
]
}
],
"package": {
"name": "piscina",
"purl": "pkg:npm/piscina",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-67c8-pqhq-4rmx/GHSA-67c8-pqhq-4rmx.json"
}
}
]- Related CVEs
- CVE-2026-102992
Source reference:
/aliases
Publisher severity
critical
Source reference: /database_specific/severity
- Event
- #61026 · Revision 1
- Added to Heist Feed
- Publisher date