Tinypool versions before 2.1.1 construct the ThreadPool.options object by copying properties from a normal options object, including execArgv and env worker options. Because these properties are read from an object that may have been polluted via Object.prototype, inherited malicious properties can be copied into own properties and passed to worker_threads.Worker. This prototype pollution enables attackers to inject JavaScript code that is executed in each newly spawned worker process with the same privileges as the host process. The issue is resolved in version 2.1.1.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in worker threads with the privileges of the host process. This can lead to unauthorized access to sensitive information such as CI secrets, signing material, or build artifacts. The vulnerability poses a critical risk to the confidentiality and integrity of affected systems.

Upgrade tinypool to version 2.1.1 or later, where this prototype pollution vulnerability is fixed. No other mitigations are specified or recommended by the vendor advisory.