{
  "schemaVersion": 1,
  "site": "https://cveboard.org",
  "generatedAt": "2026-10-23T19:18:19.445Z",
  "lastRun": "2026-10-23T19:01:02.861Z",
  "liveDays": 14,
  "filters": {
    "kind": null,
    "exploited": false,
    "severity": null,
    "ecosystems": [],
    "tag": "tinylibs"
  },
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incidents": [
    {
      "id": "cve-2026-104848",
      "url": "https://cveboard.org/i/cve-2026-104848",
      "urlPt": "https://cveboard.org/pt/i/cve-2026-104848",
      "json": "https://cveboard.org/i/cve-2026-104848.json",
      "kind": "vuln",
      "live": false,
      "knownExploited": false,
      "severity": "critical",
      "title": "Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution",
      "summary": "tinypool passes worker options to new Worker() by reading them off a plain object whose prototype is Object.prototype. Options the application did not set are resolved through the prototype chain and then passed explicitly to worker_threads.Worker.",
      "titlePt": "Tinypool: gadget de poluição de protótipo nas opções do worker leva à execução remota de código",
      "summaryPt": "tinypool passa as opções do worker para new Worker() lendo-as de um objeto simples cujo protótipo é Object.prototype. Opções que a aplicação não definiu são resolvidas através da cadeia de protótipos e, em seguida, passadas explicitamente para worker_threads.Worker.",
      "affected": [
        {
          "vendor": "tinylibs",
          "product": "tinypool",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "< 2.1.1",
              "status": "affected",
              "lessThan": null,
              "lessThanOrEqual": null
            }
          ],
          "omitted": 0,
          "fixed": []
        }
      ],
      "omitted": 0,
      "references": [
        {
          "url": "https://github.com/tinylibs/tinypool/security/advisories/GHSA-5gmw-xhrv-c9v3",
          "tag": "exploit"
        }
      ],
      "cwes": [
        {
          "id": "CWE-1321",
          "name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"
        }
      ],
      "ssvc": {
        "exploitation": "poc",
        "automatable": "no",
        "impact": "total",
        "at": "2026-10-02T17:29:00.481Z"
      },
      "fix": "listed",
      "tags": [
        "tinylibs",
        "npm"
      ],
      "cves": [
        "CVE-2026-104848"
      ],
      "ghsa": "GHSA-5gmw-xhrv-c9v3",
      "cvss": {
        "score": 9.5,
        "version": "4.0",
        "by": "GitHub"
      },
      "epss": {
        "percentage": 0.00497,
        "percentile": 0.41725,
        "asOf": "2026-10-23",
        "by": "FIRST"
      },
      "packages": [
        {
          "ecosystem": "npm",
          "name": "tinypool",
          "vulnerable": "<= 2.1.0",
          "fixed": "2.1.1",
          "advisory": "GHSA-5gmw-xhrv-c9v3"
        }
      ],
      "vendor": "tinylibs",
      "product": "tinypool",
      "kev": null,
      "breach": null,
      "retracted": false,
      "sources": [
        {
          "label": "GitHub Advisory Database",
          "url": "https://github.com/advisories/GHSA-5gmw-xhrv-c9v3"
        }
      ],
      "publishedAt": "2026-10-05T22:50:01.000Z",
      "updatedAt": "2026-10-05T22:50:01.000Z"
    },
    {
      "id": "cve-2026-104849",
      "url": "https://cveboard.org/i/cve-2026-104849",
      "urlPt": "https://cveboard.org/pt/i/cve-2026-104849",
      "json": "https://cveboard.org/i/cve-2026-104849.json",
      "kind": "vuln",
      "live": false,
      "knownExploited": false,
      "severity": "critical",
      "title": "Tinypool: Prototype Pollution Gadget to RCE in run() options",
      "summary": "tinypool is a fork of piscina and inherited the same prototype-pollution surface. When pool.run(task, options) is called, the filename option is read from the provided options object. If that object does not have an own filename property, the lookup falls through to Object.prototype.",
      "titlePt": "Tinypool: Gadget de poluição de protótipo para RCE nas opções de run()",
      "summaryPt": "tinypool é um fork de piscina e herdou a mesma superfície de poluição de protótipo. Quando pool.run(task, options) é chamado, a opção filename é lida do objeto options fornecido. Se esse objeto não tiver uma propriedade filename própria, a busca cai para Object.prototype.",
      "affected": [
        {
          "vendor": "tinylibs",
          "product": "tinypool",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "< 2.1.2",
              "status": "affected",
              "lessThan": null,
              "lessThanOrEqual": null
            }
          ],
          "omitted": 0,
          "fixed": []
        }
      ],
      "omitted": 0,
      "references": [
        {
          "url": "https://github.com/tinylibs/tinypool/security/advisories/GHSA-85c8-ppgw-ccpr",
          "tag": "exploit"
        }
      ],
      "cwes": [
        {
          "id": "CWE-94",
          "name": "Improper Control of Generation of Code ('Code Injection')"
        },
        {
          "id": "CWE-1321",
          "name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"
        }
      ],
      "ssvc": {
        "exploitation": "poc",
        "automatable": "yes",
        "impact": "total",
        "at": "2026-10-06T16:35:41.151Z"
      },
      "fix": "listed",
      "tags": [
        "tinylibs",
        "npm"
      ],
      "cves": [
        "CVE-2026-104849"
      ],
      "ghsa": "GHSA-85c8-ppgw-ccpr",
      "cvss": {
        "score": 9.5,
        "version": "4.0",
        "by": "GitHub"
      },
      "epss": {
        "percentage": 0.0039,
        "percentile": 0.31893,
        "asOf": "2026-10-23",
        "by": "FIRST"
      },
      "packages": [
        {
          "ecosystem": "npm",
          "name": "tinypool",
          "vulnerable": "< 2.1.2",
          "fixed": "2.1.2",
          "advisory": "GHSA-85c8-ppgw-ccpr"
        }
      ],
      "vendor": "tinylibs",
      "product": "tinypool",
      "kev": null,
      "breach": null,
      "retracted": false,
      "sources": [
        {
          "label": "GitHub Advisory Database",
          "url": "https://github.com/advisories/GHSA-85c8-ppgw-ccpr"
        }
      ],
      "publishedAt": "2026-10-05T22:49:52.000Z",
      "updatedAt": "2026-10-05T22:49:52.000Z"
    }
  ],
  "tag": {
    "tag": "tinylibs",
    "name": "tinylibs",
    "kev": null
  }
}