Prototype Pollution RCE in piscina (CVE-2025-55388)

Vulnerability Overview Prototype Pollution Gadget → RCE via inherited options.filename Vulnerability Type: Remote Code Execution (RCE) caused by Prototype Pollution Affected Library: (npm) CVE ID: CVE-2025-55388 Severity: 8.1 / 10 (HIGH) Description: The vulnerability stems from a prototype pollution issue in the library when processing , allowing attackers to execute arbitrary code by polluting the prototype chain. The vulnerability exists in 's constructor and method, accessible via the path. Scope of Impact Affected Versions: - - - Fixed Versions: - - - Impact: - Upstream prototype pollution sources may commonly appear in transitive dependencies within the process. - An attacker can control files under known filesystem paths, leading to real-time uploads, transient race conditions, predictable paths, or supply chain attacks. - Once triggered, the entire process is hijacked. The attacker can read application data from each request, control return values, and persist the compromise until the process restarts. Remediation Minimal Fix: - Add own-property checks at the two locations where options are read: More Idiomatic Fix: - Use an object with a null prototype throughout the handling of : Proof of Concept (PoC) A) Minimal In-Process PoC B) Full-Stack HTTP Chain (Realistic Scenario) Additional Information Coordination: Coordinated with the maintainers of the library; public disclosure is planned for 90 days after the GHSA publication. Discovery Process: By generalizing the disclosure mechanism, we identified that any library reading string options and accessing them via the prototype chain and dynamic loading (e.g., or ) could be a candidate. Scanning 10 candidate libraries, was independently affected via its own options reading path.

Goal Reached Thanks to every supporter — we hit 100%!

Prototype Pollution RCE in piscina (CVE-2025-55388)

More from this source