CVE-2026-55388

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55388
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55388.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55388
Aliases
Downstream
Related
Published
2026-06-22T16:50:40Z
Modified
2026-08-12T03:51:17Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
piscina: Prototype Pollution Gadget → RCE via inherited options.filename
Details

piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn't have filename as an own property. When Object.prototype.filename is polluted upstream the inherited value flows to worker_threads.Worker import and the attacker's .mjs runs in the worker. This vulnerability is fixed in 6.0.0-rc.2, 5.2.0, and 4.9.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1321",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55388.json"
}
References

Affected packages

Git / github.com/piscinajs/piscina

Affected ranges

Type
GIT
Repo
https://github.com/piscinajs/piscina
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4440ae15037b2462549943ba9ab66da0b87f906d
Introduced
d973eacf68ea5deef9e58270ae17d13c86e532dc
Fixed
8baaa1bdd5d515b5061cec3ed307ebcabd8f70b8
Introduced
b4efcca7250abe82cef143e4507b09fbca86aad8
Fixed
a11c26c8eee08bdc97b731fdd660d84585c25fee
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.9.3"
        },
        {
            "introduced": "5.0.0-alpha.0"
        },
        {
            "fixed": "5.2.0"
        },
        {
            "introduced": "6.0.0-rc.1"
        },
        {
            "fixed": "6.0.0-rc.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v.*
v.4.9.0
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.2.1
v1.3.0
v1.4.0
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v2.*
v2.0.0
v2.1.0
v2.2.0
v3.*
v3.0.0
v3.1.0
v3.2.0
v4.*
v4.0.0
v4.1.0
v4.2.0
v4.2.1
v4.3.0
v4.3.1
v4.3.2
v4.4.0
v4.5.0
v4.5.1
v4.5.2
v4.6.0
v4.6.1
v4.7.0
v4.8.0
v4.9.1
v4.9.2
v5.*
v5.0.0
v5.0.0-alpha.0
v5.0.0-alpha.1
v5.0.0-alpha.2
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v6.*
v6.0.0-rc.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55388.json"