CVE-2026-104848

CriticalCVSS 9.5

Published: 02/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Summary

Tinypool prior to 2.1.1 constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to worker_threads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload arguments or NODE_OPTIONS, resulting in code execution with the host process's privileges and possible access to CI secrets, signing material, or build artifacts. This issue is fixed in version 2.1.1.

Risk Assessment

The risk includes arbitrary code execution with host process privileges and potential access to sensitive data such as CI secrets, signing material, or build artifacts, which could lead to severe security compromise.

Recommendation

It is recommended to upgrade Tinypool to version 2.1.1 or later and protect against prototype pollution to prevent attackers from manipulating worker options.

Other vulnerabilities in Tinypool

CVE-2026-104849Critical
Tinypool prior to 2.1.2 reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.

Original NVD description (English source)

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to worker_threads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload arguments or NODE_OPTIONS, resulting in code execution with the host process's privileges and possible access to CI secrets, signing material, or build artifacts. This issue is fixed in version 2.1.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS