CVE-2026-102992

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102992", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-29T20:46:08.334Z", "datePublished": "2026-09-30T19:50:18.036Z", "dateUpdated": "2026-09-30T20:47:49.562Z"}, "containers": {"cna": {"title": "piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env", "problemTypes": [{"descriptions": [{"cweId": "CWE-1321", "lang": "en", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx"}, {"name": "https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f", "tags": ["x_refsource_MISC"], "url": "https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f"}, {"name": "https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72", "tags": ["x_refsource_MISC"], "url": "https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72"}, {"name": "https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7", "tags": ["x_refsource_MISC"], "url": "https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7"}, {"name": "https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6", "tags": ["x_refsource_MISC"], "url": "https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6"}, {"name": "https://github.com/piscinajs/piscina/releases/tag/v4.9.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/piscinajs/piscina/releases/tag/v4.9.4"}, {"name": "https://github.com/piscinajs/piscina/releases/tag/v5.3.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/piscinajs/piscina/releases/tag/v5.3.2"}, {"name": "https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5"}], "affected": [{"vendor": "piscinajs", "product": "piscina", "versions": [{"version": "< 4.9.4", "status": "affected"}, {"version": ">= 5.0.0, < 5.3.2", "status": "affected"}, {"version": ">= 6.0.0-rc.1, < 6.0.0-rc.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-30T19:50:18.036Z"}, "descriptions": [{"lang": "en", "value": "piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5."}], "source": {"advisory": "GHSA-67c8-pqhq-4rmx", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-30T20:47:28.974211Z", "id": "CVE-2026-102992", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T20:47:49.562Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102992", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-30T20:47:28.974211Z"}}}], "references": [{"url": "https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T20:47:44.299Z"}}], "cna": {"title": "piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env", "source": {"advisory": "GHSA-67c8-pqhq-4rmx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "piscinajs", "product": "piscina", "versions": [{"status": "affected", "version": "< 4.9.4"}, {"status": "affected", "version": ">= 5.0.0, < 5.3.2"}, {"status": "affected", "version": ">= 6.0.0-rc.1, < 6.0.0-rc.5"}]}], "references": [{"url": "https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx", "name": "https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f", "name": "https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72", "name": "https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7", "name": "https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6", "name": "https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/piscinajs/piscina/releases/tag/v4.9.4", "name": "https://github.com/piscinajs/piscina/releases/tag/v4.9.4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/piscinajs/piscina/releases/tag/v5.3.2", "name": "https://github.com/piscinajs/piscina/releases/tag/v5.3.2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5", "name": "https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-30T19:50:18.036Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102992", "state": "PUBLISHED", "dateUpdated": "2026-09-30T20:47:49.562Z", "dateReserved": "2026-09-29T20:46:08.334Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-30T19:50:18.036Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "piscina", "vendor": "piscinajs", "versions": [{"status": "affected", "version": "< 4.9.4"}, {"status": "affected", "version": ">= 5.0.0, < 5.3.2"}, {"status": "affected", "version": ">= 6.0.0-rc.1, < 6.0.0-rc.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5."}], "id": "CVE-2026-102992", "lastModified": "2026-09-30T21:17:06.450", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102992", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-30T20:47:28.974211Z", "version": "2.0.3"}}]}, "published": "2026-09-30T20:17:27.080", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f"}, {"source": "security-advisories@github.com", "url": "https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72"}, {"source": "security-advisories@github.com", "url": "https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7"}, {"source": "security-advisories@github.com", "url": "https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6"}, {"source": "security-advisories@github.com", "url": "https://github.com/piscinajs/piscina/releases/tag/v4.9.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/piscinajs/piscina/releases/tag/v5.3.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "piscina: piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env", "id": "2544267", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544267"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-915", "details": ["piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5.", "A flaw was found in piscina. This vulnerability allows an attacker to achieve arbitrary code execution by leveraging inherited configuration options. The worker pool stores options in a standard object that inherits base JavaScript properties without defining defaults for all sensitive parameters. An attacker who can manipulate shared object properties (prototype pollution) within the host application can inject malicious execution arguments, executing arbitrary code within worker threads or altering the runtime environment."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-102992", "public_date": "2026-09-30T19:50:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102992\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102992\nhttps://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f\nhttps://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72\nhttps://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7\nhttps://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6\nhttps://github.com/piscinajs/piscina/releases/tag/v4.9.4\nhttps://github.com/piscinajs/piscina/releases/tag/v5.3.2\nhttps://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5\nhttps://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx"], "statement": "This vulnerability is rated as Important because it enables arbitrary code execution within Node.js worker threads or the main process if an attacker can manipulate the global prototype chain. Although the potential blast radius involves complete compromise of the running application, exploitation is not directly exposed by the library itself and depends on an existing prototype pollution primitive elsewhere in the application stack.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.9.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.3.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0-rc.1,6.0.0-rc.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "piscina", "source": "cna", "vendor": "piscinajs"}, "product": "piscina", "vendor": "piscinajs"}], "created": "2026-09-30T22:45:16.978222+00:00", "updated": "2026-10-10T02:00:11.801880+00:00", "vendors": ["piscinajs", "piscinajs$PRODUCT$piscina"], "weaknesses": ["CWE-1321", "CWE-915"]}