{"action":"Upgrade piscina to 4.9.3 or later.","affected":[{"fixed":"5.2.0","introduced":"5.0.0-alpha.0"},{"fixed":"4.9.3","introduced":"0"},{"fixed":"6.0.0-rc.2","introduced":"6.0.0-rc.1"}],"component":"piscina","cve_ids":["CVE-2026-55388"],"ecosystem":"npm","epss":0.00454,"exploited":false,"fixed_versions":["5.2.0","4.9.3","6.0.0-rc.2"],"ghsa_id":"GHSA-x9g3-xrwr-cwfg","id":"tcs_01M5KGHGXDFKPW720AE19YXMGC","modified_at":"2026-09-10T03:50:12.257395202Z","published_at":"2026-06-18T13:05:11Z","references":["https://osv.dev/vulnerability/GHSA-x9g3-xrwr-cwfg","https://github.com/piscinajs/piscina/security/advisories/GHSA-x9g3-xrwr-cwfg","https://github.com/piscinajs/piscina"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-x9g3-xrwr-cwfg","url":"https://osv.dev/vulnerability/GHSA-x9g3-xrwr-cwfg"}],"summary":"piscina: Prototype Pollution Gadget → RCE via inherited options.filename"}