CVE-2026-55388
HIGH EPSS 21.3%
Published Jun 22, 20261w ago · Modified Jun 23, 20261w ago
8.1 CVSS 3.1
Published Jun 22, 2026 1w ago
Last Modified Jun 23, 2026 1w ago
Description
piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn't have filename as an own property. When Object.prototype.filename is polluted upstream the inherited value flows to worker_threads.Worker import and the attacker's .mjs runs in the worker. This vulnerability is fixed in 6.0.0-rc.2, 5.2.0, and 4.9.3.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
21.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-1321
CWE-94 Improper Control of Generation of Code (Code Injection) Injection
References 1
- github.com https://github.com/piscinajs/piscina/security/advisories/GHSA-x9g3-xrwr-cwfg
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.