Piscina
Monthly
Prototype-pollution gadget in the Piscina Node.js worker-pool library allows an attacker who already controls a separate prototype-pollution primitive in the host application to escalate that primitive into worker-thread code preload and execution: an inherited execArgv value is passed straight to the Node.js Worker constructor, an inherited loadBalancer function runs during task scheduling, and inherited env values reshape worker environments. The flaw affects Piscina releases before 4.9.4 (4.x), before 5.3.2 (5.x), and before 6.0.0-rc.5 (6.x RC); exploitation is unauthenticated from Piscina's perspective and needs no user interaction, but the assessed vector (AV:N/AC:H, CVSS 4.0 AT:P) confirms it is not standalone-exploitable without a pre-existing prototype-pollution bug in the consuming application. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Prototype-pollution gadget in the Piscina Node.js worker-pool library allows an attacker who already controls a separate prototype-pollution primitive in the host application to escalate that primitive into worker-thread code preload and execution: an inherited execArgv value is passed straight to the Node.js Worker constructor, an inherited loadBalancer function runs during task scheduling, and inherited env values reshape worker environments. The flaw affects Piscina releases before 4.9.4 (4.x), before 5.3.2 (5.x), and before 6.0.0-rc.5 (6.x RC); exploitation is unauthenticated from Piscina's perspective and needs no user interaction, but the assessed vector (AV:N/AC:H, CVSS 4.0 AT:P) confirms it is not standalone-exploitable without a pre-existing prototype-pollution bug in the consuming application. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).