CVE-2026-104849: Tinypool: Prototype Pollution Gadget to RCE in run() options
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tinypoolto a version that resolves this vulnerability.Fixed in 2.1.2
Event History
Frequently Asked Questions
Which uses of pool.run() are exposed?
Only applications that pass their own options object as the second argument to pool.run(task, options) are affected. Calls that omit the second argument use Tinypool's trusted default options object and are not affected by this issue.
What must an attacker be able to do to exploit this?
The attacker must first be able to pollute Object.prototype and must be able to cause a vulnerable pool.run() call that receives a caller-supplied options object. A polluted Object.prototype.filename can then select the JavaScript module loaded by the worker pool.
What is the impact if exploitation succeeds?
An attacker can cause the worker pool to load attacker-selected JavaScript. The loaded code can read or modify task data with the host process's privileges.
What version fixes the issue?
Upgrade Tinypool to version 2.1.2 or later. Versions prior to 2.1.2 are affected when the vulnerable call pattern is used.