Skip to content
OpenAdvisories

Package · npm

piscina

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.2
    CVE-2026-102992

    piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

    piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can the…

    piscinajs piscina python-tensorboard piscina Azure Linux npm
  • High 8.1
    CVE-2026-55388

    piscina: Prototype Pollution Gadget → RCE via inherited options.filename

    piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn'…

    piscinajs piscina katib-suggestion-hyperopt katib-earlystopping Wolfi npm