Piscina, a Node.js worker pool library, prior to versions 4.9.4, 5.3.2, and 6.0.0-rc.5, stores ThreadPool.options as a plain object inheriting from Object.prototype. This design flaw allows prototype pollution where an attacker can supply inherited properties for options without own defaults. Specifically, an inherited execArgv value can be passed to the Node.js Worker constructor, enabling preloading of attacker-controlled code in worker threads. Additionally, an inherited loadBalancer function can execute during task scheduling, and inherited env values can modify worker environments. These behaviors can lead to code execution and environment manipulation within worker threads. The issue is resolved in the stated fixed versions.

An attacker can exploit this vulnerability to execute arbitrary code in worker threads by injecting malicious execArgv values. They can also influence task scheduling through a malicious loadBalancer function and alter the environment variables of worker threads. This can lead to significant security breaches including remote code execution and unauthorized environment manipulation. The CVSS 4.0 score of 9.2 reflects a critical severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required.

Upgrade piscina to version 4.9.4, 5.3.2, or 6.0.0-rc.5 or later, where this prototype pollution vulnerability is fixed. No other mitigation is required as the issue is resolved in these official releases.