CVE-2026-104849 is a code injection vulnerability in tinypool before version 2.1.2. Tinypool's pool.run(task, options) method reads the filename property from the options object without verifying it is an own property, allowing an attacker who can pollute Object.prototype.filename to cause the worker pool to load arbitrary JavaScript code. This enables the attacker to read or modify task data with the privileges of the host process. The vulnerability only affects applications that pass their own options object to pool.run(); calls without this argument use a trusted default. The issue is resolved in tinypool version 2.1.2.

An attacker capable of polluting the Object.prototype.filename property and influencing the options argument to pool.run() can cause tinypool to load and execute arbitrary JavaScript code within the worker pool. This leads to code injection with the privileges of the host process, potentially allowing unauthorized data access or modification. The vulnerability does not affect applications that do not pass a custom options object to pool.run().

Upgrade tinypool to version 2.1.2 or later, where this vulnerability is fixed. Applications that do not pass a custom options object to pool.run() are not affected. There is no indication of alternative mitigations; applying the official fix is recommended.