AIKIDO-2026-266277

TL;DR

Piscina builds its thread-pool options and per-task run and close options by spreading caller-supplied options into plain objects that inherit from Object.prototype. When Object.prototype is polluted elsewhere in the process, inherited properties such as execArgv, loadBalancer, env, and resourceLimits are read as pool and worker configuration. A polluted execArgv forces every worker thread to preload and execute an externally controlled module, giving remote code execution, while loadBalancer and env allow further code and configuration injection. The fix copies only own properties into null-prototype objects for the constructor, pool, run, and close options so polluted prototype values can no longer influence configuration.