2vulnerabilities
- Critical1 (50.0%)
- High1 (50.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
piscina
Ecosystem: npm
Downloads:
- 1CriticalAffects 3 versions
- 1HighAffects 3 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting piscina, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-67c8-pqhq-4rmx | Critical | piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env### Summary A prototype-pollution gadget in `ThreadPool.options` allows an attacker who can pollute `Object.prototype` to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that `ThreadPool.options` is created as a plain object inheriting from `Object.prototype`, so any option without an explicit default in `kDefaultOptions` can be supplied via the prototype chain. ### Details In `src/index.ts` the `ThreadPool` constructor builds the resolved options object as a plain object: ` |
| GitHub (opens in a new tab) | |
| GHSA-x9g3-xrwr-cwfg | High | piscina: Prototype Pollution Gadget → RCE via inherited options.filename## Summary `piscina`'s constructor and `run()` paths read the `filename` option via plain member access: ```js // dist/index.js line 92 (constructor) const filename = options.filename ? (0, common_1.maybeFileURLToPath)(options.filename) : null; this.options = { ...kDefaultOptions, ...options, filename, maxQueue: 0 }; // dist/index.js line 616 (run()) run(task, options = kDefaultRunOptions) { if (options === null || typeof options !== 'object') { return Promise.reject(new TypeError('options must be an object')); } const { transferList, filename, name, signal } = optio |
| GitHub (opens in a new tab) |
- GHSA-67c8-pqhq-4rmxCriticalpiscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
>= 5.0.0, < 5.3.2< 4.9.4- +1 more
Affected versions:>= 5.0.0, < 5.3.2< 4.9.4>= 6.0.0-rc.1, < 6.0.0-rc.5
### Summary A prototype-pollution gadget in `ThreadPool.options` allows an attacker who can pollute `Object.prototype` to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that `ThreadPool.options` is created as a plain object inheriting from `Object.prototype`, so any option without an explicit default in `kDefaultOptions` can be supplied via the prototype chain. ### Details In `src/index.ts` the `ThreadPool` constructor builds the resolved options object as a plain object: `
CVE: CVE-2026-102992
- GHSA-x9g3-xrwr-cwfgHighpiscina: Prototype Pollution Gadget → RCE via inherited options.filename
>= 5.0.0-alpha.0, < 5.2.0< 4.9.3- +1 more
Affected versions:>= 5.0.0-alpha.0, < 5.2.0< 4.9.3>= 6.0.0-rc.1, < 6.0.0-rc.2
## Summary `piscina`'s constructor and `run()` paths read the `filename` option via plain member access: ```js // dist/index.js line 92 (constructor) const filename = options.filename ? (0, common_1.maybeFileURLToPath)(options.filename) : null; this.options = { ...kDefaultOptions, ...options, filename, maxQueue: 0 }; // dist/index.js line 616 (run()) run(task, options = kDefaultRunOptions) { if (options === null || typeof options !== 'object') { return Promise.reject(new TypeError('options must be an object')); } const { transferList, filename, name, signal } = optio
CVE: CVE-2026-55388