CVE-2026-104848: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

Q: Which deployments are exposed?

Tinypool versions before 2.1.1 are affected when an attacker can pollute Object.prototype with either the execArgv or env property. The impact occurs when Tinypool subsequently spawns new workers.

Q: What must an attacker be able to do to achieve code execution?

The attacker must first gain a way to pollute Object.prototype for execArgv or env. Tinypool can then copy the inherited value into worker options and pass it to worker_threads.Worker, enabling attacker-selected JavaScript to be loaded through preload arguments or NODE_OPTIONS.

Q: What is the immediate remediation?

Upgrade Tinypool to version 2.1.1, which fixes the issue. If immediate patching is not possible, prevent untrusted input from reaching any prototype-pollution path and avoid spawning new Tinypool workers after suspected pollution.

Q: What privileges does successful exploitation provide?

Injected JavaScript executes with the privileges of the host process. In CI or build environments, this may expose secrets, signing material, and build artifacts available to that process.

Published Oct 2, 2026

Updated

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to workerthreads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload arguments or NODEOPTIONS, resulting in code execution with the host process's privileges and possible access to CI secrets, signing material, or build artifacts. This issue is fixed in version 2.1.1.

Affected Software

1 affected component

npm/tinypool<2.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Tinypool to a version that resolves this vulnerability.
Fixed in 2.1.1

Event History

Oct 2, 2026

CVE Published

via MITRE·04:15 PM

Data Sourced

via MITRE·04:15 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Tinypool versions before 2.1.1 are affected when an attacker can pollute Object.prototype with either the execArgv or env property. The impact occurs when Tinypool subsequently spawns new workers.

What must an attacker be able to do to achieve code execution?

The attacker must first gain a way to pollute Object.prototype for execArgv or env. Tinypool can then copy the inherited value into worker options and pass it to worker_threads.Worker, enabling attacker-selected JavaScript to be loaded through preload arguments or NODE_OPTIONS.

What is the immediate remediation?

Upgrade Tinypool to version 2.1.1, which fixes the issue. If immediate patching is not possible, prevent untrusted input from reaching any prototype-pollution path and avoid spawning new Tinypool workers after suspected pollution.

What privileges does successful exploitation provide?

Injected JavaScript executes with the privileges of the host process. In CI or build environments, this may expose secrets, signing material, and build artifacts available to that process.

CVE-2026-104848: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What must an attacker be able to do to achieve code execution?

What is the immediate remediation?

What privileges does successful exploitation provide?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker be able to do to achieve code execution?

What is the immediate remediation?

What privileges does successful exploitation provide?