CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
938 vulnerabilities reference this CWE, most recent first.
GHSA-65P9-J6PG-72HJ
Vulnerability from github – Published: 2025-06-04 03:30 – Updated: 2025-07-29 21:42billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "billboard.js"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.15.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-49223"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-29T21:42:33Z",
"nvd_published_at": "2025-06-04T03:15:27Z",
"severity": "CRITICAL"
},
"details": "billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
"id": "GHSA-65p9-j6pg-72hj",
"modified": "2025-07-29T21:42:33Z",
"published": "2025-06-04T03:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49223"
},
{
"type": "WEB",
"url": "https://github.com/naver/billboard.js/commit/82ea7ac4f5720d6a7f0c2fa5a5dad51a549667bb"
},
{
"type": "WEB",
"url": "https://cve.naver.com/detail/cve-2025-49223.html"
},
{
"type": "WEB",
"url": "https://github.com/louay-075/CVE-2025-49223-BillboardJS-PoC"
},
{
"type": "PACKAGE",
"url": "https://github.com/naver/billboard.js"
},
{
"type": "WEB",
"url": "https://github.com/naver/billboard.js/blob/938f263feca453fba5a4dc48d86b32cc5b509443/src/core.ts#L95"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "billboard.js allows prototype pollution via the function generate"
}
GHSA-65RP-MHQF-8GJ3
Vulnerability from github – Published: 2023-02-24 06:30 – Updated: 2023-03-03 00:12All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "rangy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-26102"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-24T16:23:36Z",
"nvd_published_at": "2023-02-24T05:15:00Z",
"severity": "HIGH"
},
"details": "All versions of the package rangy are vulnerable to Prototype Pollution when using the `extend()` function in file `rangy-core.js`.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype.",
"id": "GHSA-65rp-mhqf-8gj3",
"modified": "2023-03-03T00:12:19Z",
"published": "2023-02-24T06:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26102"
},
{
"type": "WEB",
"url": "https://github.com/timdown/rangy/issues/478"
},
{
"type": "PACKAGE",
"url": "https://github.com/timdown/rangy"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-RANGY-3175702"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "rangy vulnerable to Prototype Pollution"
}
GHSA-664H-WQGQ-64GW
Vulnerability from github – Published: 2026-07-24 16:22 – Updated: 2026-08-13 17:27Impact
What kind of vulnerability is it? Who is impacted?
Prototype pollution in update casting: passing a user-controlled update to a Mongoose update, like MyModel.updateOne(filter, req.body), can cause Mongoose to set $fullPath and $parentSchemaDocArray on Object.prototype.
Example:
const mongoose = require('mongoose');
console.log('before:', Object.prototype.$fullPath); // undefined
const User = mongoose.model('User', new mongoose.Schema({ name: String }));
const malicious = JSON.parse('{"$set": {"__proto__.x": "anything"}}'); // attacker-controlled update
const q = User.updateOne({}, {});
try { q._castUpdate(malicious); } catch (e) { /* throws AFTER the pollution side-effect */ }
console.log('after :', Object.prototype.$fullPath); // "__proto__"
console.log('enumerable:', Object.prototype.propertyIsEnumerable('$fullPath')); // true
console.log('fresh {}:', ({}).$fullPath); // "__proto__"
Patches
Has the problem been patched? What versions should users upgrade to?
9.7.2, 8.24.1. 7.8.10, 6.13.10
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Check user-controlled updates for own __proto__ properties before passing to Mongoose
References
Are there any links users can visit to find out more?
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "mongoose"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.13.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "mongoose"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.8.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "mongoose"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.24.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "mongoose"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.7.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-73562"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T16:22:34Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nPrototype pollution in update casting: passing a user-controlled update to a Mongoose update, like `MyModel.updateOne(filter, req.body)`, can cause Mongoose to set `$fullPath` and `$parentSchemaDocArray` on `Object.prototype`.\n\nExample:\n\n```javascript\nconst mongoose = require(\u0027mongoose\u0027);\nconsole.log(\u0027before:\u0027, Object.prototype.$fullPath); // undefined\n\nconst User = mongoose.model(\u0027User\u0027, new mongoose.Schema({ name: String }));\nconst malicious = JSON.parse(\u0027{\"$set\": {\"__proto__.x\": \"anything\"}}\u0027); // attacker-controlled update\n\nconst q = User.updateOne({}, {});\ntry { q._castUpdate(malicious); } catch (e) { /* throws AFTER the pollution side-effect */ }\n\nconsole.log(\u0027after :\u0027, Object.prototype.$fullPath); // \"__proto__\"\nconsole.log(\u0027enumerable:\u0027, Object.prototype.propertyIsEnumerable(\u0027$fullPath\u0027)); // true\nconsole.log(\u0027fresh {}:\u0027, ({}).$fullPath); // \"__proto__\"\n```\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n9.7.2, 8.24.1. 7.8.10, 6.13.10\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nCheck user-controlled updates for own `__proto__` properties before passing to Mongoose\n\n### References\n_Are there any links users can visit to find out more?_",
"id": "GHSA-664h-wqgq-64gw",
"modified": "2026-08-13T17:27:25Z",
"published": "2026-07-24T16:22:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-664h-wqgq-64gw"
},
{
"type": "WEB",
"url": "https://github.com/Automattic/mongoose/pull/16230"
},
{
"type": "WEB",
"url": "https://github.com/Automattic/mongoose/commit/f494b8430f9097fc70446d6949c8a42a27518e0b"
},
{
"type": "PACKAGE",
"url": "https://github.com/Automattic/mongoose"
},
{
"type": "WEB",
"url": "https://github.com/Automattic/mongoose/releases/tag/6.13.10"
},
{
"type": "WEB",
"url": "https://github.com/Automattic/mongoose/releases/tag/7.8.10"
},
{
"type": "WEB",
"url": "https://github.com/Automattic/mongoose/releases/tag/8.24.1"
},
{
"type": "WEB",
"url": "https://github.com/Automattic/mongoose/releases/tag/9.7.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)"
}
GHSA-66RH-8FW6-59Q6
Vulnerability from github – Published: 2019-08-21 16:15 – Updated: 2022-08-03 16:21Versions of assign-deep prior to 1.0.1 and 0.4.8 are vulnerable to Prototype Pollution. The assign function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.
Recommendation
Upgrade to versions 1.0.1, 0.4.8, or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "assign-deep"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "assign-deep"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.0.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.0"
]
}
],
"aliases": [
"CVE-2019-10745"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-20",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2019-08-21T15:53:43Z",
"nvd_published_at": "2019-08-20T19:15:00Z",
"severity": "HIGH"
},
"details": "Versions of `assign-deep` prior to 1.0.1 and 0.4.8 are vulnerable to Prototype Pollution. The `assign` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.\n\n## Recommendation\n\nUpgrade to versions 1.0.1, 0.4.8, or later.",
"id": "GHSA-66rh-8fw6-59q6",
"modified": "2022-08-03T16:21:27Z",
"published": "2019-08-21T16:15:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10745"
},
{
"type": "WEB",
"url": "https://github.com/jonschlinkert/assign-deep/commit/8e3cc4a34246733672c71e96532105384937e56c"
},
{
"type": "WEB",
"url": "https://github.com/jonschlinkert/assign-deep/commit/90bf1c551d05940898168d04066bbf15060f50cc"
},
{
"type": "PACKAGE",
"url": "https://github.com/jonschlinkert/assign-deep"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-ASSIGNDEEP-450211"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1014"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "assign-deep Vulnerable to Prototype Pollution"
}
GHSA-675M-85RW-J3W4
Vulnerability from github – Published: 2019-02-07 18:17 – Updated: 2023-09-07 18:30Versions of just-extend before 4.0.0 are vulnerable to prototype pollution. Provided certain input just-extend can add or modify properties of the Object prototype. These properties will be present on all objects.
Recommendation
Update to version 4.0.0 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "just-extend"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-16489"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:18:13Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Versions of `just-extend` before 4.0.0 are vulnerable to prototype pollution. Provided certain input `just-extend` can add or modify properties of the `Object` prototype. These properties will be present on all objects.\n\n\n## Recommendation\n\nUpdate to version `4.0.0` or later.",
"id": "GHSA-675m-85rw-j3w4",
"modified": "2023-09-07T18:30:55Z",
"published": "2019-02-07T18:17:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16489"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/430291"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-675m-85rw-j3w4"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/780"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in just-extend"
}
GHSA-679F-58PQ-4V2C
Vulnerability from github – Published: 2026-09-10 21:05 – Updated: 2026-09-10 21:05Impact
The Instance AI workflow summary built its result with get-or-create-then-nested-write idioms keyed by node names and connection keys taken from the stored workflow. Those are arbitrary strings: the restricted-name guard n8n shows in the editor is client-side and is bypassed by posting the workflow to the REST API directly. So a reserved key such as __proto__ resolved up the prototype chain instead of creating an own key, and the write landed on Object.prototype in the main n8n process, affecting every later request. The patch builds the summary with null-prototype accumulators and validates the keys it accepts, so reserved names cannot reach the prototype chain.
Patches
The issue has been fixed in n8n versions 2.37.7 and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Remove or leave unconfigured the N8N_INSTANCE_AI_MODEL* environment variables to prevent the Instance AI module from reaching the vulnerable code path.
- Restart the n8n process to clear any in-memory prototype pollution if an attack is suspected.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.38.0"
},
{
"fixed": "2.38.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.37.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-86078"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-10T21:05:24Z",
"nvd_published_at": "2026-09-08T22:19:16Z",
"severity": "MODERATE"
},
"details": "## Impact\n\nThe Instance AI workflow summary built its result with get-or-create-then-nested-write idioms keyed by node names and connection keys taken from the stored workflow. Those are arbitrary strings: the restricted-name guard n8n shows in the editor is client-side and is bypassed by posting the workflow to the REST API directly. So a reserved key such as `__proto__` resolved up the prototype chain instead of creating an own key, and the write landed on `Object.prototype` in the main n8n process, affecting every later request. The patch builds the summary with null-prototype accumulators and validates the keys it accepts, so reserved names cannot reach the prototype chain.\n\n## Patches\n\nThe issue has been fixed in n8n versions 2.37.7 and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Remove or leave unconfigured the `N8N_INSTANCE_AI_MODEL*` environment variables to prevent the Instance AI module from reaching the vulnerable code path.\n- Restart the n8n process to clear any in-memory prototype pollution if an attack is suspected.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
"id": "GHSA-679f-58pq-4v2c",
"modified": "2026-09-10T21:05:24Z",
"published": "2026-09-10T21:05:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86078"
},
{
"type": "PACKAGE",
"url": "https://github.com/n8n-io/n8n"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"
},
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service"
}
GHSA-67C8-PQHQ-4RMX
Vulnerability from github – Published: 2026-10-01 15:03 – Updated: 2026-10-01 15:03Summary
A prototype-pollution gadget in ThreadPool.options allows an attacker who can pollute Object.prototype to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that ThreadPool.options is created as a plain object inheriting from Object.prototype, so any option without an explicit default in kDefaultOptions can be supplied via the prototype chain.
Details
In src/index.ts the ThreadPool constructor builds the resolved options object as a plain object:
this.options = { ...kDefaultOptions, ...options, filename, maxQueue: 0 }
Because this object has Object.prototype as its prototype, reads for properties that are not own properties of the object and are not present in kDefaultOptions fall back to Object.prototype. This means a prototype-pollution primitive (e.g. from a vulnerable merge() or JSON.parse merge elsewhere in the application) can inject values for execArgv, env, loadBalancer, argv, workerData, resourceLimits, niceIncrement, closeTimeout, recordTiming, stricterFIFO, workerHistogram, and trackUnmanagedFds.
The most serious gadget is execArgv, which is passed directly to new Worker(..., { execArgv }). An attacker can set Object.prototype.execArgv = ['--require', '/tmp/attacker.js'], causing every worker to preload and execute the attacker-controlled module on startup.
This issue survived the fix for GHSA-x9g3-xrwr-cwfg / CVE-2026-55388 ("Prototype Pollution Gadget → RCE via inherited options.filename"). That advisory hardened the Piscina constructor's filename read and run()'s filename/name reads, but ThreadPool.options itself was not created with a null prototype. The same class of attack is therefore still possible against any option without an explicit default in kDefaultOptions.
PoC
import { resolve } from 'node:path'
import Piscina from 'piscina'
Object.prototype.execArgv = ['--require', '/tmp/attacker.js']
const pool = new Piscina({
filename: resolve(import.meta.dirname, 'worker.js'),
minThreads: 1,
maxThreads: 1,
})
await pool.run(1)
/tmp/attacker.js is executed in the worker on startup. A full reproduction repository with execArgv, loadBalancer, and env vectors is available at https://github.com/Fcmam5/piscina-pp-poc.
Impact
- Remote Code Execution: via
execArgv(arbitrary--requiremodule preloaded in every worker on spawn). - Arbitrary code execution in the main thread: via
loadBalancer, an attacker-supplied function that is called during task scheduling. - Environment/CLI option injection: via
env, which is passed to each worker constructor. - Denial of Service / unexpected behavior: via other reachable options such as
workerData,resourceLimits,niceIncrement,closeTimeout,recordTiming, etc.
Anyone using Piscina in an application where Object.prototype can be polluted (e.g. through a dependency with a prototype-pollution vulnerability) is impacted.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "piscina"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.3.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "piscina"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.9.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "piscina"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0-rc.1"
},
{
"fixed": "6.0.0-rc.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-102992"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-01T15:03:33Z",
"nvd_published_at": "2026-09-30T20:17:27Z",
"severity": "CRITICAL"
},
"details": "### Summary\n\nA prototype-pollution gadget in `ThreadPool.options` allows an attacker who can pollute `Object.prototype` to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that `ThreadPool.options` is created as a plain object inheriting from `Object.prototype`, so any option without an explicit default in `kDefaultOptions` can be supplied via the prototype chain.\n\n### Details\n\nIn `src/index.ts` the `ThreadPool` constructor builds the resolved options object as a plain object:\n\n```ts\nthis.options = { ...kDefaultOptions, ...options, filename, maxQueue: 0 }\n```\n\nBecause this object has `Object.prototype` as its prototype, reads for properties that are not own properties of the object and are not present in `kDefaultOptions` fall back to `Object.prototype`. This means a prototype-pollution primitive (e.g. from a vulnerable `merge()` or `JSON.parse` merge elsewhere in the application) can inject values for `execArgv`, `env`, `loadBalancer`, `argv`, `workerData`, `resourceLimits`, `niceIncrement`, `closeTimeout`, `recordTiming`, `stricterFIFO`, `workerHistogram`, and `trackUnmanagedFds`.\n\nThe most serious gadget is `execArgv`, which is passed directly to `new Worker(..., { execArgv })`. An attacker can set `Object.prototype.execArgv = [\u0027--require\u0027, \u0027/tmp/attacker.js\u0027]`, causing every worker to preload and execute the attacker-controlled module on startup.\n\nThis issue survived the fix for **GHSA-x9g3-xrwr-cwfg / CVE-2026-55388** (\"Prototype Pollution Gadget \u2192 RCE via inherited options.filename\"). That advisory hardened the `Piscina` constructor\u0027s `filename` read and `run()`\u0027s `filename`/`name` reads, but `ThreadPool.options` itself was not created with a null prototype. The same class of attack is therefore still possible against any option without an explicit default in `kDefaultOptions`.\n\n### PoC\n\n```js\nimport { resolve } from \u0027node:path\u0027\nimport Piscina from \u0027piscina\u0027\n\nObject.prototype.execArgv = [\u0027--require\u0027, \u0027/tmp/attacker.js\u0027]\n\nconst pool = new Piscina({\n filename: resolve(import.meta.dirname, \u0027worker.js\u0027),\n minThreads: 1,\n maxThreads: 1,\n})\n\nawait pool.run(1)\n```\n\n`/tmp/attacker.js` is executed in the worker on startup. A full reproduction repository with `execArgv`, `loadBalancer`, and `env` vectors is available at https://github.com/Fcmam5/piscina-pp-poc.\n\n### Impact\n\n- **Remote Code Execution**: via `execArgv` (arbitrary `--require` module preloaded in every worker on spawn).\n- **Arbitrary code execution in the main thread**: via `loadBalancer`, an attacker-supplied function that is called during task scheduling.\n- **Environment/CLI option injection**: via `env`, which is passed to each worker constructor.\n- **Denial of Service / unexpected behavior**: via other reachable options such as `workerData`, `resourceLimits`, `niceIncrement`, `closeTimeout`, `recordTiming`, etc.\n\nAnyone using Piscina in an application where `Object.prototype` can be polluted (e.g. through a dependency with a prototype-pollution vulnerability) is impacted.",
"id": "GHSA-67c8-pqhq-4rmx",
"modified": "2026-10-01T15:03:33Z",
"published": "2026-10-01T15:03:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102992"
},
{
"type": "WEB",
"url": "https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f"
},
{
"type": "WEB",
"url": "https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72"
},
{
"type": "WEB",
"url": "https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7"
},
{
"type": "WEB",
"url": "https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6"
},
{
"type": "PACKAGE",
"url": "https://github.com/piscinajs/piscina"
},
{
"type": "WEB",
"url": "https://github.com/piscinajs/piscina/releases/tag/v4.9.4"
},
{
"type": "WEB",
"url": "https://github.com/piscinajs/piscina/releases/tag/v5.3.2"
},
{
"type": "WEB",
"url": "https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env"
}
GHSA-67MQ-H2R9-RH2M
Vulnerability from github – Published: 2021-04-13 15:23 – Updated: 2022-12-03 03:51This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "multi-ini"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-28460"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-07T23:23:09Z",
"nvd_published_at": "2020-12-22T13:15:00Z",
"severity": "MODERATE"
},
"details": "This affects the package multi-ini before 2.1.2. It is possible to pollute an object\u0027s prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.",
"id": "GHSA-67mq-h2r9-rh2m",
"modified": "2022-12-03T03:51:28Z",
"published": "2021-04-13T15:23:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28460"
},
{
"type": "WEB",
"url": "https://github.com/evangelion1204/multi-ini/commit/6b2212b2ce152c19538a2431415f72942c5a1bde"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-MULTIINI-1053229"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype pollution in multi-ini"
}
GHSA-6956-83FG-5WC5
Vulnerability from github – Published: 2022-03-18 00:01 – Updated: 2022-03-29 21:05The package set-in before 2.0.3 is vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of CVE-2020-28273
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "set-in"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25354"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-18T22:42:31Z",
"nvd_published_at": "2022-03-17T12:15:00Z",
"severity": "CRITICAL"
},
"details": "The package set-in before 2.0.3 is vulnerable to Prototype Pollution via the `setIn` method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)",
"id": "GHSA-6956-83fg-5wc5",
"modified": "2022-03-29T21:05:15Z",
"published": "2022-03-18T00:01:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25354"
},
{
"type": "WEB",
"url": "https://github.com/ahdinosaur/set-in/commit/6bad255961d379e4b1f5fbc52ef9dc8420816f24"
},
{
"type": "PACKAGE",
"url": "https://github.com/ahdinosaur/set-in"
},
{
"type": "WEB",
"url": "https://github.com/ahdinosaur/set-in/blob/dfc226d95cce8129de6708661e06e0c2c06f3490/index.js%23L5"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-SETIN-2388571"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in set-in"
}
GHSA-69R2-2FG7-7HF9
Vulnerability from github – Published: 2024-06-17 15:30 – Updated: 2024-08-02 15:48A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@abw/badger-database"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-36581"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-17T21:37:51Z",
"nvd_published_at": "2024-06-17T15:15:51Z",
"severity": "HIGH"
},
"details": "A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm.",
"id": "GHSA-69r2-2fg7-7hf9",
"modified": "2024-08-02T15:48:36Z",
"published": "2024-06-17T15:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36581"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/f6b2ed1b3b4bc0df994c7455fc6110bd"
},
{
"type": "PACKAGE",
"url": "https://github.com/abw/badger-database-js"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Badger Database Prototype Pollution"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.