CVE-2026-104849: Tinypool: Prototype Pollution Gadget to RCE in run() options

package.json

@@ -38,7 +38,8 @@
   },
   "overrides": {
     "braces": "$braces",
-    "http-cache-semantics": "$http-cache-semantics"
+    "http-cache-semantics": "$http-cache-semantics",
+    "tinypool": "2.1.2"
   },
   "browserslist": {
     "production": [

tests/fixtures/tinypool/legitimate-worker.mjs

@@ -0,0 +1,10 @@
+/**
+ * Fixture worker for tests/tinypool-security.test.mjs.
+ *
+ * The worker a pool is constructed with. It reports who processed the task
+ * so a test can tell the two fixtures apart from the response alone.
+ */
+export default async (task) => ({
+  by: 'legitimate',
+  processed: task,
+});

tests/fixtures/tinypool/malicious-worker.mjs

@@ -0,0 +1,11 @@
+/**
+ * Fixture worker for tests/tinypool-security.test.mjs.
+ *
+ * The worker an attacker would point Object.prototype.filename at. Its
+ * response shape is different on purpose: any result carrying `stolen`
+ * proves the task was redirected away from the legitimate worker.
+ */
+export default async (task) => ({
+  by: 'attacker',
+  stolen: task,
+});