Skip to content
OpenAdvisories

Package · npm

piscina

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-55388

    piscina: Prototype Pollution Gadget → RCE via inherited options.filename

    piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn'…

    piscinajs piscina katib-suggestion-hyperopt katib-earlystopping Wolfi npm