Tinypool: Prototype pollution in worker options allows code execution
Summary
Tinypool, a Node.js worker thread pool library often used in build and test pipelines, copies inherited values from a polluted Object.prototype into the worker options execArgv and env. An attacker who can first pollute one of these properties can make every newly started worker load attacker-chosen JavaScript, with the privileges of the host process. Exploitation requires an existing prototype pollution primitive in the same application or toolchain, and the impact can include access to CI secrets, signing keys and build artifacts.
Affected
- tinylibs Tinypool versions before 2.1.1 (CNA record: < 2.1.1; GitHub advisory: <= 2.1.0)
- Transitive dependencies, for example via vitest 3.x, which pins tinypool ^1.1.1
Fixed in
- Tinypool 2.1.1 (per vendor advisory GHSA-5gmw-xhrv-c9v3, fix commit 24df4e7, PR #134)
- A second advisory, CVE-2026-104849, is reported as fixed in 2.1.2 (not verified in vendor data)
Workaround
- No vendor workaround documented. The remedy is to upgrade.
- Until the upgrade is done, restrict CI secrets and signing keys to the jobs that need them.
Exploitation
- CISA SSVC assessment: exploitation status 'poc' (proof of concept exists), not automatable, total technical impact.
- Public technical details are available in the vendor advisory.
- Not listed as known exploited in the sources reviewed (CISA KEV not checked directly).
- EPSS 0.00497 (low predicted exploitation probability).
Our recommendation
- Identify all projects and CI runners that use tinypool, including transitive dependencies (for example via vitest), with npm ls tinypool.
- Upgrade tinypool to 2.1.2 or later, or at least 2.1.1. Note that vitest 3.x may require an override or an upgrade to vitest 4.x; test this before rollout.
- Rebuild CI runners and rotate secrets if untrusted code or prototype pollution may have affected builds.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5gmw-xhrv-c9v3 github.com
- Tinypool release v2.1.1 github.com
- Fix commit 24df4e7 github.com
- Pull Request #134 github.com
- GitHub Advisory Database GHSA-5gmw-xhrv-c9v3 github.com
- GitLab Advisory CVE-2026-104848 advisories.gitlab.com
- Vulners CVELIST:CVE-2026-104848 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:34.
Original description (NVD)
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to worker_threads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload arguments or NODE_OPTIONS, resulting in code execution with the host process's privileges and possible access to CI secrets, signing material, or build artifacts. This issue is fixed in version 2.1.1.
NVD references (5)
- https://github.com/tinylibs/tinypool/commit/24df4e730e7d0857a6d226c9b58f8924227404fd
- https://github.com/tinylibs/tinypool/pull/134
- https://github.com/tinylibs/tinypool/releases/tag/v2.1.1
- https://github.com/tinylibs/tinypool/security/advisories/GHSA-5gmw-xhrv-c9v3
- https://github.com/tinylibs/tinypool/security/advisories/GHSA-5gmw-xhrv-c9v3
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.