CVE-2026-104848
Received Received - Intake

Prototype Pollution Leads to RCE in Tinypool

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: GitHub, Inc.

Description
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to worker_threads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload arguments or NODE_OPTIONS, resulting in code execution with the host process's privileges and possible access to CI secrets, signing material, or build artifacts. This issue is fixed in version 2.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104848
EUVD
EUVD-2026-91718

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
tinypool tinypool to 2.1.1 (inc)
tinylibs tinypool 2.1.1
tinylibs tinypool to 2.1.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Tinypool (versions <=2.1.0) is a Prototype Pollution gadget that allows Remote Code Execution. It occurs because Tinypool passes worker options to Node.js's Worker constructor by reading them from a plain object with Object.prototype in its prototype chain. When options are inherited from the prototype chain and passed to worker_threads.Worker, Node.js ignores them. However, Tinypool re-materializes these inherited options as own properties, bypassing this protection. Attackers can pollute Object.prototype.execArgv or Object.prototype.env to inject malicious JavaScript into newly spawned workers.

Detection Guidance

To detect this vulnerability, check if your system uses tinypool versions <=2.1.0. Run: npm list tinypool. If vulnerable, inspect for prototype pollution in worker options by checking Object.prototype.execArgv and Object.prototype.env for unexpected values.

Impact Analysis

An attacker who exploits this can execute arbitrary code with the host process's privileges. This could lead to access to CI secrets, signing material, or build artifacts. Since Tinypool is used by Vitest (with ~42M weekly downloads), the impact includes developer machines and CI runners. The attack can originate from any dependency chain where a prototype pollution primitive exists.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data such as personal information or health records. This may violate GDPR's data protection requirements or HIPAA's security rules, depending on the data involved. Organizations using affected versions may face compliance breaches if attackers gain access to regulated data.

Mitigation Strategies

Upgrade tinypool to version 2.1.1 or later immediately. Update dependencies in package.json and run npm update. If upgrading is not possible, implement input validation to prevent prototype pollution in worker options.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104848. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart