CVE-2026-104849
Tinypool: Prototype Pollution Gadget to RCE in run() options
tinypool is a fork of piscina and inherited the same prototype-pollution surface. When pool.run(task, options) is called, the filename option is read from the provided options object. If that object does not have an own filename property, the lookup falls through to Object.prototype.
- No known exploitation
- Severity
- Critical, CVSS 9.5 (v4.0)
- EPSS
- 0.39% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- tinypool (npm) < 2.1.2, fixed in 2.1.2 · GHSA-85c8-ppgw-ccpr