{
  "schemaVersion": 1,
  "incident": {
    "id": "cve-2026-104849",
    "url": "https://cveboard.org/i/cve-2026-104849",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-104849",
    "json": "https://cveboard.org/i/cve-2026-104849.json",
    "kind": "vuln",
    "live": false,
    "knownExploited": false,
    "severity": "critical",
    "title": "Tinypool: Prototype Pollution Gadget to RCE in run() options",
    "summary": "tinypool is a fork of piscina and inherited the same prototype-pollution surface. When pool.run(task, options) is called, the filename option is read from the provided options object. If that object does not have an own filename property, the lookup falls through to Object.prototype.",
    "titlePt": "Tinypool: Gadget de poluição de protótipo para RCE nas opções de run()",
    "summaryPt": "tinypool é um fork de piscina e herdou a mesma superfície de poluição de protótipo. Quando pool.run(task, options) é chamado, a opção filename é lida do objeto options fornecido. Se esse objeto não tiver uma propriedade filename própria, a busca cai para Object.prototype.",
    "cves": [
      "CVE-2026-104849"
    ],
    "ghsa": "GHSA-85c8-ppgw-ccpr",
    "cvss": {
      "score": 9.5,
      "version": "4.0"
    },
    "epss": {
      "percentage": 0.0039,
      "percentile": 0.3158,
      "asOf": "2026-10-23"
    },
    "packages": [
      {
        "ecosystem": "npm",
        "name": "tinypool",
        "vulnerable": "< 2.1.2",
        "fixed": "2.1.2",
        "advisory": "GHSA-85c8-ppgw-ccpr"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-85c8-ppgw-ccpr"
      }
    ],
    "publishedAt": "2026-10-05T22:49:52.000Z",
    "updatedAt": "2026-10-05T22:49:52.000Z"
  },
  "live": false,
  "events": [
    {
      "id": "ghsa:GHSA-85c8-ppgw-ccpr:ghsa_published:2026-10-05T22:49:52.000Z",
      "incidentId": "cve-2026-104849",
      "type": "ghsa_published",
      "at": "2026-10-05T22:49:52.000Z",
      "detail": {
        "ghsa": "GHSA-85c8-ppgw-ccpr",
        "severity": "critical",
        "fixed": "2.1.2"
      }
    }
  ]
}