Read the docs
TI-2026-66134 Aliases CVE-2026-104848GHSA-5gmw-xhrv-c9v3

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

Priority HIGH 76CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to worker_threads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload arguments or NODE_OPTIONS, resulting in code execution with the host process's privileges and possible access to CI secrets, signing material, or build artifacts. This issue is fixed in version 2.1.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00497 42nd percentileScored 2026-11-07
Fix Partial tinypool (tinylibs): 2.1.1tinypool (npm): 2.1.1Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tinylibstinypoolbefore 2.1.12.1.1Patch availableCNA
—tinypool (npm)before 2.1.12.1.1Patch availableGHSA-5gmw-xhrv-c9v3
  • tinypool Vendortinylibs Affected before 2.1.1 Fixed in 2.1.1 Patch available CNA
  • tinypool (npm) Vendor— Affected before 2.1.1 Fixed in 2.1.1 Patch available GHSA-5gmw-xhrv-c9v3

Remediation

  • Fix · CNA tinypool (tinylibs) Fixed in 2.1.1
  • Fix · GHSA-5gmw-xhrv-c9v3 tinypool (npm) Fixed in 2.1.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Build of Podman DesktopAffectedNo fix planned: Will not fix
Not affected: 5 products
  • Red Hat AMQ Broker 7
  • Red Hat Ansible Automation Platform 2
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-104848
  2. 2026-10-06 Alias added: GHSA-5gmw-xhrv-c9v3
  3. 2026-10-06 Fix available: npm/[email protected] · GHSA-5gmw-xhrv-c9v3
  4. 2026-10-06 CVSS score added · GHSA-5gmw-xhrv-c9v3
  5. 2026-10-06 Weakness changed · GHSA-5gmw-xhrv-c9v3
  6. 2026-10-06 6 new references · GHSA-5gmw-xhrv-c9v3
  7. 2026-10-07 Affected versions changed · Red Hat
  8. 2026-10-07 CVSS score added · Red Hat
  9. 2026-10-08 Affected versions changed · Red Hat
  10. 2026-10-09 Affected versions changed · Red Hat
  11. 2026-10-10 Affected versions changed · Red Hat

References

Advisory 1

Other 5

  • TI-2026-66135 Tinypool: Prototype Pollution Gadget to RCE in run() options CVSS 4.0CRITICAL 9.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences