High [CVE-2026-55388] Arbitrary code execution via prototype pollution of filename option
This high-severity Red Hat Linux advisory covers CVE-2026-55388.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access.
Both reads fall through the prototype chain when the caller's options object doesn't have filename as an own property. When Object.prototype.filename is polluted upstream the inherited value flows to worker_threads.
Worker import and the attacker's.mjs runs in the worker. This vulnerability is fixed in 6.0.0-rc.2, 5.2.0, and 4.9.3.
This vulnerability allows an attacker to achieve arbitrary code execution by exploiting a prototype pollution issue. By manipulating the `filename` option, an attacker can cause their malicious code to be executed within the worker, potentially compromising the system's confidentiality, integrity, and availability.
Red Hat products are not affected by this vulnerability as the vulnerable code is not present in Red Hat's `piscina` implementation. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Weakness: CWE-915.
- < 6.0.0-rc
- < 5.2.0
- < 4.9.3
Official advisory · high-confidence parse· fetched 21 days ago·verify at source
- 6.0.0
- 5.2.0
- 4.9.3
Official advisory · high-confidence parse· fetched 21 days ago·verify at source
Mitigation
Upgrade to a fixed release: 6.0.0, 5.2.0, 4.9.3. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 21 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.