Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-102992: Piscina package can let attackers run code
CVE-2026-102992 · published 1 day ago
Summary
The JavaScript library called piscina (used by several projects) has a flaw that could let a malicious user cause the program to run unwanted code. Updating to one of the newly released versions fixes the problem. Apply the latest version of piscina to all your applications as soon as possible.
What to do
- Update metcoder95 piscina to version 5.3.2.
- Update metcoder95 piscina to version 4.9.4.
- Update metcoder95 piscina to version 6.0.0-rc.5.
- Update piscina to version 5.3.2.
- Update piscina to version 4.9.4.
- Update piscina to version 6.0.0-rc.5.
- Update piscina to version 4.9.3-aikido.1.
- Update rootio @rootio/piscina to version 4.9.3-root.io.1.
- Update piscina to version 5.3.1-aikido.1.
- Update rootio @rootio/piscina to version 5.3.1-root.io.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | piscinajs | piscina | < 4.9.4 |
| npm | metcoder95 | piscina |
>= 5.0.0, < 5.3.2 < 4.9.4 >= 6.0.0-rc.1, < 6.0.0-rc.5 Fix: upgrade to 5.3.2
|
| npm | – | piscina |
>= 5.0.0, < 5.3.2 < 4.9.4 >= 6.0.0-rc.1, < 6.0.0-rc.5 Fix: upgrade to 5.3.2
|
| Root:npm | – | piscina |
< 4.9.3-aikido.1 < 5.3.1-aikido.1 Fix: upgrade to 4.9.3-aikido.1
|
| Root:npm | rootio | @rootio/piscina |
< 4.9.3-root.io.1 < 5.3.1-root.io.1 Fix: upgrade to 4.9.3-root.io.1
|
Original advisory text
CVE-2026-102992 in piscina - Patched by Root
Root has patched CVE-2026-102992 in the piscina package for Root:npm. Multiple fixed versions available.
References
- https://github.com/piscinajs/piscina/releases/tag/v4.9.4
- https://github.com/piscinajs/piscina/releases/tag/v5.3.2
- https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc...
- https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19f...
- https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx
- https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d6...
- https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41...
- https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1029... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102992
- https://github.com/advisories/GHSA-67c8-pqhq-4rmx
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-1321Prototype Pollution
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen30 Sep 2026
Sources
CVE-2026-102992 · NVD
CVE-2026-102992 · MITRE
CVE-2026-102992 · OSV
GHSA-67c8-pqhq-4rmx · GHSA
Track software like this
Free during beta