CVE-2026-102992 (GCVE-0-2026-102992)
Vulnerability from cvelistv5
Published
2026-09-30 19:50
Modified
2026-09-30 20:47
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Summary
piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5.
References
| URL | Tags | |
|---|---|---|
|
|
||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102992",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T20:47:28.974211Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T20:47:49.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "piscina",
"vendor": "piscinajs",
"versions": [
{
"status": "affected",
"version": "\u003c 4.9.4"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.3.2"
},
{
"status": "affected",
"version": "\u003e= 6.0.0-rc.1, \u003c 6.0.0-rc.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T19:50:18.036Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx"
},
{
"name": "https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f"
},
{
"name": "https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72"
},
{
"name": "https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7"
},
{
"name": "https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6"
},
{
"name": "https://github.com/piscinajs/piscina/releases/tag/v4.9.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/piscinajs/piscina/releases/tag/v4.9.4"
},
{
"name": "https://github.com/piscinajs/piscina/releases/tag/v5.3.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/piscinajs/piscina/releases/tag/v5.3.2"
},
{
"name": "https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5"
}
],
"source": {
"advisory": "GHSA-67c8-pqhq-4rmx",
"discovery": "UNKNOWN"
},
"title": "piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102992",
"datePublished": "2026-09-30T19:50:18.036Z",
"dateReserved": "2026-09-29T20:46:08.334Z",
"dateUpdated": "2026-09-30T20:47:49.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-102992\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-30T20:47:28.974211Z\"}}}], \"references\": [{\"url\": \"https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-30T20:47:44.299Z\"}}], \"cna\": {\"title\": \"piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env\", \"source\": {\"advisory\": \"GHSA-67c8-pqhq-4rmx\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 9.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"piscinajs\", \"product\": \"piscina\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 4.9.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= 5.0.0, \u003c 5.3.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 6.0.0-rc.1, \u003c 6.0.0-rc.5\"}]}], \"references\": [{\"url\": \"https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx\", \"name\": \"https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f\", \"name\": \"https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72\", \"name\": \"https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7\", \"name\": \"https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6\", \"name\": \"https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/piscinajs/piscina/releases/tag/v4.9.4\", \"name\": \"https://github.com/piscinajs/piscina/releases/tag/v4.9.4\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/piscinajs/piscina/releases/tag/v5.3.2\", \"name\": \"https://github.com/piscinajs/piscina/releases/tag/v5.3.2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5\", \"name\": \"https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1321\", \"description\": \"CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-30T19:50:18.036Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-102992\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-30T20:47:49.562Z\", \"dateReserved\": \"2026-09-29T20:46:08.334Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-30T19:50:18.036Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…