CVE-2026-55388 piscina: Prototype Pollution Gadget → RCE via inherited options.filename
Attackers can achieve remote code execution in piscina worker pools by polluting the prototype to inject malicious filenames, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55388?
CVE-2026-55388 is a high-severity code injection vulnerability in piscinajs piscina, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn't have filename as an own property. When Object.prototype.filename is polluted upstream the inherited value flows to worker_threads.Worker import and the attacker's .mjs runs in the worker. This vulnerability is fixed in 6.0.0-rc.2, 5.2.0, and 4.9.3.
Which versions are affected by CVE-2026-55388?
6 open source packages ship an affected version, including piscina.
| Package | Affected | Fixed in |
|---|---|---|
piscina npm | All versions | 4.9.3 |
piscina npm | All versions | 4.9.3 |
piscina npm | From 5.0.0-alpha.0 | 5.2.0 |
piscina npm | From 5.0.0-alpha.0 | 5.2.0 |
piscina npm | From 6.0.0-rc.1 | 6.0.0-rc.2 |
piscina npm | From 6.0.0-rc.1 | 6.0.0-rc.2 |
How do I fix CVE-2026-55388?
Upgrade piscina to a fixed version for your release line: 4.9.3, 5.2.0 or 6.0.0-rc.2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-55388 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55388 exists.
Sources
Also known as CLSA-2026-1784943103, CLSA-2026-1792231948, CLSA-2026-1792232060, ECHO-56d0-8d0e-4fc0, GHSA-x9g3-xrwr-cwfg, MINI-ff39-9whx-5gjq and 8 more.