https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 07:09:03 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-382422 EUVD-2026-382422 https://cve.radiocsirt.org/vuln/euvd-2026-382422 https://cve.radiocsirt.org/vuln/fkie_cve-2026-104849 <p>Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process&#39;s privileges. This issue is fixed in version 2.1.2.</p> <p>Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process&#39;s privileges. This issue is fixed in version 2.1.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-104849 https://cve.radiocsirt.org/vuln/ghsa-85c8-ppgw-ccpr <p><strong>Affected:</strong> npm: tinypool</p> <p>`tinypool` is a fork of `piscina` and inherited the same prototype-pollution surface. When `pool.run(task, options)` is called, the `filename` option is read from the provided `options` object. If that object does not have an own `filename` property, the lookup falls through to `Object.prototype`.</p> <p>An attacker who can pollute `Object.prototype.filename` (for example, via a vulnerable `lodash.merge`, `qs.parse`, or similar elsewhere in the application) can make tinypool load and execute an attacker-controlled worker module.</p> <p>This is the tinypool counterpart to the piscina root discovery [GHSA-x9g3-xrwr-cwfg](https://github.com/piscinajs/piscina/security/advisories/GHSA-x9g3-xrwr-cwfg).</p> <p>`pool.run(task)` with no second argument is not affected, because `kDefaultOptions.filename` is `null` and the options object is not user-controlled. The exploit only triggers when the caller passes their own options object to `pool.run()`.</p> <p>## Impact</p> <p>Arbitrary JavaScript execution in the worker pool. If the application passes attacker-controlled data as the `run()` task and also supplies a `run()` options object, the attacker can redirect execution to a malicious worker that exfiltrates or modifies that data, achieving remote code execution and/or data exfiltration.</p> <p>## Proof of Concept</p> <p>```js // legitimate-worker.mjs export default async (task) =&gt; ({ by: &#39;legitimate-worker&#39;, processed: task })</p> <p>// malicious-worker.mjs export default async (task) =&gt; ({ by: &#39;attacker&#39;, stolenRequestBody: task…</p> <p><strong>Affected:</strong> npm: tinypool</p> <p>`tinypool` is a fork of `piscina` and inherited the same prototype-pollution surface. When `pool.run(task, options)` is called, the `filename` option is read from the provided `options` object. If that object does not have an own `filename` property, the lookup falls through to `Object.prototype`.</p> <p>An attacker who can pollute `Object.prototype.filename` (for example, via a vulnerable `lodash.merge`, `qs.parse`, or similar elsewhere in the application) can make tinypool load and execute an attacker-controlled worker module.</p> <p>This is the tinypool counterpart to the piscina root discovery [GHSA-x9g3-xrwr-cwfg](https://github.com/piscinajs/piscina/security/advisories/GHSA-x9g3-xrwr-cwfg).</p> <p>`pool.run(task)` with no second argument is not affected, because `kDefaultOptions.filename` is `null` and the options object is not user-controlled. The exploit only triggers when the caller passes their own options object to `pool.run()`.</p> <p>## Impact</p> <p>Arbitrary JavaScript execution in the worker pool. If the application passes attacker-controlled data as the `run()` task and also supplies a `run()` options object, the attacker can redirect execution to a malicious worker that exfiltrates or modifies that data, achieving remote code execution and/or data exfiltration.</p> <p>## Proof of Concept</p> <p>```js // legitimate-worker.mjs export default async (task) =&gt; ({ by: &#39;legitimate-worker&#39;, processed: task })</p> <p>// malicious-worker.mjs export default async (task) =&gt; ({ by: &#39;attacker&#39;, stolenRequestBody: task…</p> https://cve.radiocsirt.org/vuln/ghsa-85c8-ppgw-ccpr