Executive brief
Piscina is a popular Node.js library used to manage background tasks and improve application performance. A vulnerability allows an attacker to trick the library into loading and executing malicious code instead of the intended background task. This could lead to full system compromise, data theft, or the ability to manipulate application responses, especially if the application is already vulnerable to other common web flaws like prototype pollution.
Technical details
Piscina's constructor and 'run()' methods access the 'filename' property from the provided options object using plain member access. Because these methods do not verify if 'filename' is an 'own property' of the options object, the lookup falls through the prototype chain. If an attacker has successfully polluted 'Object.prototype.filename' via a separate vulnerability (e.g., in lodash or minimist), Piscina will use the polluted string as the path for a new 'worker_threads.Worker'. If the attacker can also place a malicious '.mjs' file on the filesystem, they achieve arbitrary code execution within the worker context. This allows the attacker to intercept task data, modify return values, and persist across the process lifetime. The issue is fixed in versions 4.9.3, 5.2.0, and 6.0.0-rc.2 by implementing own-property guards.
Affected products
- piscinajs piscina < 4.9.3, >= 5.0.0-alpha.0 < 5.2.0, >= 6.0.0-rc.1 < 6.0.0-rc.2
Timeline
- 2026-06-16: disclosed: Advisory published by researcher
- 2026-06-22: advisory: CVE published to NVD