GHSA-5GMW-XHRV-C9V3 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

tinypool passes worker options to new Worker by reading them off a plain object whose prototype is Object.prototype. Options the application did not set are resolved through the prototype chain and then passed explicitly to workerthreads.Worker. Node core ignores Worker options inherited from...

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

tinypool passes worker options to new Worker by reading them off a plain object whose prototype is Object.prototype. Options the application did not set are resolved through the prototype chain and then passed explicitly to workerthreads.Worker. Node core ignores Worker options inherited from...

CVE-2026-104848

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own...

CVE-2026-104848 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own...

CVE-2026-104848 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own...

Prototype Pollution

piscina is vulnerable to Prototype Pollution. The vulnerability is due to storing security-sensitive ThreadPool.options in a plain object that inherits attacker-influenced properties, which allows an attacker with a separate prototype-pollution primitive to inject values such as execArgv,...

PT-2026-104402

Name of the Vulnerable Software and Affected Versions Tinypool versions prior to 2.1.1 Description Tinypool constructs ThreadPool.options from a standard options object and reads the execArgv and env worker options in dist/index.js. This process allows values inherited from a polluted...

CVE-2026-104848: Improperly Controlled Modification of Object Prototype Attributes

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own...

vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

Summary On Node.js 24 and newer, vm2 can expose the host node:test module to sandboxed NodeVM code when the embedder explicitly allows the node:test builtin. Sandbox code can reach that module through require'node:node:test' and call run with attacker-controlled execArgv. node:test.run starts a...

GHSA-QHWX-74W5-XHXQ vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

Summary On Node.js 24 and newer, vm2 can expose the host node:test module to sandboxed NodeVM code when the embedder explicitly allows the node:test builtin. Sandbox code can reach that module through require'node:node:test' and call run with attacker-controlled execArgv. node:test.run starts a...

NPM: vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

NPM: vm2: NodeVM builtin allowlist bypass via node:test.run execArgv allows sandbox escape vulnerability discovered by ? in WordPress Npm vm2 versions = 3.9.6, = 3.11.6...

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

Summary A prototype-pollution gadget in ThreadPool.options allows an attacker who can pollute Object.prototype to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that...

NPM: piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

NPM: piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env vulnerability discovered by ? in WordPress Npm piscina versions 4.9.4...

EUVD-2026-90364

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env...

GHSA-67C8-PQHQ-4RMX piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

Summary A prototype-pollution gadget in ThreadPool.options allows an attacker who can pollute Object.prototype to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that...

AZL-105657 CVE-2026-102992 affecting package python-tensorboard 2.16.2-6

piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for...

CVE-2026-102992

piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for...

CVE-2026-102992 piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for...

CVE-2026-102992

The piscina Node.js worker pool implementation is vulnerable to a prototype-pollution gadget in ThreadPool.options prior to versions 4.9.4, 5.3.2, and 6.0.0-rc.5. The root cause is that ThreadPool.options is stored as a plain object inheriting from Object.prototype in src/index.ts. If an applicat...

CVE-2026-102992 piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for...