Tinypool constructs thread pool options by copying values from a standard options object before passing them to the Node.js worker_threads.Worker constructor. When this copying is performed without protecting against Object.prototype pollution, an attacker who can inject properties onto Object.prototype can cause malicious execArgv or env values to be copied into the worker options. The attacker can then specify arbitrary JavaScript code to preload via command‑line arguments or NODE_OPTIONS, resulting in execution with the host process’s privileges. This prototype‑pollution flaw directly enables remote code execution.

The vulnerability affects the tinylibs Tinypool library, specifically all versions prior to 2.1.1. Systems using tinypool 2.1.0 or earlier, regardless of platform, are vulnerable.

The CVSS score of 9.5 indicates critical severity, and the EPSS score of 0.00497 indicates a very low probability of exploitation. Despite this low EPSS, the flaw’s nature and impact warrant treating it as high risk, especially because it can execute arbitrary code in the host process. The vulnerability is not listed in the CISA KEV catalog, but its potential to grant full process privileges means it is a serious concern. Attackers would need to influence Object.prototype in the Node.js process that uses tinypool, typically via user‑controlled input or unsanitized data paths, to trigger code execution in the host process.