Tinypool, a lightweight Node.js worker pool, is vulnerable when an attacker succeeds in polluting the Object prototype with a filename property. The polluted prototype value replaces the intended worker module loaded via pool.run(task, options). The attacker can then execute arbitrary JavaScript in the worker thread, thereby running code with the same privileges as the host process. This flaw is a classic prototype‑pollution bug (CWE‑1321) combined with code execution via dynamically loaded modules (CWE‑94).

The vulnerability affects the tinypool library distributed by tinylibs. All versions prior to 2.1.2 that allow a caller‑supplied options object to pool.run(task, options) are susceptible. Applications that invoke pool.run with a custom options argument are at risk; calls without the second argument use a trusted default and are not affected.

The CVSS score of 9.5 marks this vulnerability as critical. No EPSS data is available, so the likelihood of exploitation cannot be quantified, but the exploit requires only the ability to inject prototype properties—a common script or code injection vector. The issue is not listed in CISA's KEV catalog, meaning no documented active exploitation has been reported yet. Nonetheless, the high impact and the feasibility of prototype pollution make this a priority risk for any affected deployment.