{"schema":"threatline.record/2","record":{"id":"CVE-2026-102992","aliases":["GHSA-67c8-pqhq-4rmx"],"summary":"piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env","details":"### Summary\n\nA prototype-pollution gadget in `ThreadPool.options` allows an attacker who can pollute `Object.prototype` to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that `ThreadPool.options` is created as a plain object inheriting from `Object.prototype`, so any option without an explicit default in `kDefaultOptions` can be supplied via the prototype chain.\n\n### Details\n\nIn `src/index.ts` the `ThreadPool` constructor builds the resolved options object as a plain object:\n\n```ts\nthis.options = { ...kDefaultOptions, ...options, filename, maxQueue: 0 }\n```\n\nBecause this object has `Object.prototype` as its prototype, reads for properties that are not own properties of the object and are not present in `kDefaultOptions` fall back to `Object.prototype`. This means a prototype-pollution primitive (e.g. from a vulnerable `merge()` or `JSON.parse` merge elsewhere in the application) can inject values for `execArgv`, `env`, `loadBalancer`, `argv`, `workerData`, `resourceLimits`, `niceIncrement`, `closeTimeout`, `recordTiming`, `stricterFIFO`, `workerHistogram`, and `trackUnmanagedFds`.\n\nThe most serious gadget is `execArgv`, which is passed directly to `new Worker(..., { execArgv })`. An attacker can set `Object.prototype.execArgv = ['--require', '/tmp/attacker.js']`, causing every worker to preload and execute the attacker-controlled module on startup.\n\nThis issue survived the fix for **GHSA-x9g3-xrwr-cwfg / CVE-2026-55388** (\"Prototype Pollution Gadget → RCE via inherited options.filename\"). That advisory hardened the `Piscina` constructor's `filename` read and `run()`'s `filename`/`name` reads, but `ThreadPool.options` itself was not created with a null prototype. The same class of attack is therefore still possible against any option without an explicit default in `kDefaultOptions`.\n\n### PoC\n\n```js\nimport { resolve } from 'node:path'\nimport Piscina from 'piscina'\n\nObject.prototype.execArgv = ['--require', '/tmp/attacker.js']\n\nconst pool = new Piscina({\n  filename: resolve(import.meta.dirname, 'worker.js'),\n  minThreads: 1,\n  maxThreads: 1,\n})\n\nawait pool.run(1)\n```\n\n`/tmp/attacker.js` is executed in the worker on startup. A full reproduction repository with `execArgv`, `loadBalancer`, and `env` vectors is available at https://github.com/Fcmam5/piscina-pp-poc.\n\n### Impact\n\n- **Remote Code Execution**: via `execArgv` (arbitrary `--require` module preloaded in every worker on spawn).\n- **Arbitrary code execution in the main thread**: via `loadBalancer`, an attacker-supplied function that is called during task scheduling.\n- **Environment/CLI option injection**: via `env`, which is passed to each worker constructor.\n- **Denial of Service / unexpected behavior**: via other reachable options such as `workerData`, `resourceLimits`, `niceIncrement`, `closeTimeout`, `recordTiming`, etc.\n\nAnyone using Piscina in an application where `Object.prototype` can be polluted (e.g. through a dependency with a prototype-pollution vulnerability) is impacted.","categories":["Libraries & packages"],"product":"piscina","vendor":"piscinajs","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-67c8-pqhq-4rmx","source_modified_at":"2026-10-01T15:03:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"piscina"},"range":">= 5.0.0, < 5.3.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-67c8-pqhq-4rmx","source_modified_at":"2026-10-01T15:03:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"piscina"},"range":"< 4.9.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-67c8-pqhq-4rmx","source_modified_at":"2026-10-01T15:03:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"piscina"},"range":">= 6.0.0-rc.1, < 6.0.0-rc.5"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102992","source_modified_at":"2026-09-30T20:47:49.562Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"piscina","vendor":"piscinajs","versions":[{"version":"< 4.9.4","status":"affected"},{"version":">= 5.0.0, < 5.3.2","status":"affected"},{"version":">= 6.0.0-rc.1, < 6.0.0-rc.5","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-67c8-pqhq-4rmx","source_modified_at":"2026-10-01T15:15:09.198862052Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"piscina","ecosystem":"npm","purl":"pkg:npm/piscina"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.3.2"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-67c8-pqhq-4rmx","source_modified_at":"2026-10-01T15:15:09.198862052Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"piscina","ecosystem":"npm","purl":"pkg:npm/piscina"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.9.4"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-67c8-pqhq-4rmx","source_modified_at":"2026-10-01T15:15:09.198862052Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"piscina","ecosystem":"npm","purl":"pkg:npm/piscina"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0-rc.1"},{"fixed":"6.0.0-rc.5"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-67c8-pqhq-4rmx","source_modified_at":"2026-10-01T15:03:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"piscina"},"version":"5.3.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-67c8-pqhq-4rmx","source_modified_at":"2026-10-01T15:03:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"piscina"},"version":"4.9.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-67c8-pqhq-4rmx","source_modified_at":"2026-10-01T15:03:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"piscina"},"version":"6.0.0-rc.5"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-67c8-pqhq-4rmx","source_modified_at":"2026-10-01T15:15:09.198862052Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"piscina","ecosystem":"npm","purl":"pkg:npm/piscina"},"version":"5.3.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-67c8-pqhq-4rmx","source_modified_at":"2026-10-01T15:15:09.198862052Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"piscina","ecosystem":"npm","purl":"pkg:npm/piscina"},"version":"4.9.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-67c8-pqhq-4rmx","source_modified_at":"2026-10-01T15:15:09.198862052Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"piscina","ecosystem":"npm","purl":"pkg:npm/piscina"},"version":"6.0.0-rc.5"}],"cvss":9.2,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00434,"percentile":0.36698,"score_date":"2026-10-23"},"published_at":"2026-09-30T19:50:18.036Z","modified_at":"2026-10-01T15:15:09.198862052Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-67c8-pqhq-4rmx","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-01T15:03:34Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-102992","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-30T20:47:49.562Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-67c8-pqhq-4rmx","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-01T15:15:09.198862052Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102992","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102992","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/piscinajs/piscina/releases/tag/v4.9.4","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/piscinajs/piscina/releases/tag/v5.3.2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-67c8-pqhq-4rmx","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-09-30T20:47:28.974211Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-01T15:15:09.198862052Z","content_hash":"ffd1f8c5193c30e7a2fcfcf754c946aadc54987f90de034613da3232760fc087"}}