CVE-2026-55388GHSA-X9G3-XRWR-CWFG
piscina: Prototype Pollution Gadget → RCE via inherited options.filename
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.9.3, 5.2.0, 6.0.0-rc.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn't have filename as an own property. When Object.prototype.filename is polluted upstream the inherited value flows to worker_threads.Worker import and the attacker's .mjs runs in the worker. This vulnerability is fixed in 6.0.0-rc.2, 5.2.0, and 4.9.3.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- piscinajs piscina
fixed in 4.9.3; From 5.0.0-alpha.0 · fixed in 5.2.0; From 6.0.0-rc.1 · fixed in 6.0.0-rc.2
- piscinanpm
From 5.0.0-alpha.0 · fixed in 5.2.0
- piscinanpm
fixed in 4.9.3
- piscinanpm
From 6.0.0-rc.1 · fixed in 6.0.0-rc.2