Repository navigation
Bump tinypool to 2.1.2 to fix two prototype pollution RCE gadgets - #719
Merged
Merged
Conversation
tinypool is reachable in this repo only through oxfmt@0.46.0, a dev dependency exercised by `yarn format:check` and `yarn format:fix`. It is not Vitest that pulls it in here, and it never reaches the shipped bundle. Two prototype pollution gadgets apply to 2.1.0: - CVE-2026-104848: worker options were resolved through Object.prototype and re-materialised as own properties when handed to the worker. oxfmt sets `env` explicitly, which shadows that half, but it leaves `execArgv` unset, so that vector stayed open. - CVE-2026-104849: `pool.run(task, options)` read `filename` off the prototype chain. oxfmt calls `pool.run(task, { name: ... })` at four sites, none of which carries an own `filename`. Both are gadgets rather than standalone vulnerabilities: they need a separate prototype pollution primitive running in the oxfmt process, and the only CI job that formats untrusted content holds no secrets. The upgrade is cheap, so it is worth closing anyway. oxfmt pins tinypool at exactly 2.1.0, so a `resolutions` entry is required rather than a range bump. 2.1.2 is the first release fixing both, rebuilding options and run() arguments with Object.assign(Object.create(null), source). Verified: yarn build, yarn lint and yarn format:check all pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour. 📝 WalkthroughWalkthroughThe ChangesDependency resolution
Priority: ➖ Normal Estimated code review effort: 1 (Trivial) | ~3 minutes Change: Other Merge Risk: ⚪ Minimal · up to No actionable issue is established for this dependency update. It is mergeable after normal checks. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes Dependabot alerts #219 (CVE-2026-104848) and #218 (CVE-2026-104849), both rated CRITICAL.
What changed
One line in
package.json:oxfmt@0.46.0pins tinypool at exactly2.1.0, so aresolutionsentry is required — a range bump would not move it.2.1.2is the first release fixing both CVEs.Why
tinypoolis reachable here only throughoxfmt@0.46.0, a dev dependency exercised byyarn format:checkandyarn format:fix. Worth noting since both advisories reason about the Vitest blast radius: it is not Vitest that pulls it in in this repo, and tinypool never reaches the shipped bundle (0 occurrences inbuild/assets/*.js).Two prototype pollution gadgets applied to
2.1.0:Object.prototypeand re-materialised as own properties when handed to the worker. oxfmt setsenvexplicitly, which shadows that half, but leavesexecArgvunset, so that vector stayed open. oxfmt usesruntime: "child_process", andfork()honoursexecArgvtoo.pool.run(task, options)readfilenameoff the prototype chain. oxfmt callspool.run(task, { name: ... })at four sites, none carrying an ownfilename.Verified fixed in the installed code rather than by version number alone —
dist/index.js:470and:713now both route throughwithNullPrototype(), i.e.Object.assign(Object.create(null), source), which is exactly the remediation the advisories recommend.Risk, stated honestly
These are gadgets, not standalone vulnerabilities: triggering either needs a separate prototype pollution primitive executing inside the oxfmt process. oxfmt only discovers
.oxfmtrc.json/.oxfmtrc.jsoncand parses them on the Rust side, so there is very little to work with. Andtests.yml— the only workflow a fork PR triggers — references no secrets, so even full code execution there lands in an empty sandbox.So the real-world severity here is well below CRITICAL. The upgrade is a one-line, patch-level change, which is the reason to take it anyway rather than carry two open CRITICAL alerts.
Verification
yarn build— 464 modules transformed, succeedsyarn lint— 5 warnings, 0 errors (pre-existing, untouched)yarn format:check— 126 files across 8 threads, oxfmt's worker pool healthy on the bumped tinypoolNot included
source-map-js(alert #220, CVE-2026-93749) is deliberately left out. The patched1.2.2was published 2026-09-30 and is still quarantined by this repo'snpmMinimalAgeGate: 7d(YN0016: All versions satisfying "^1.2.2" are quarantined). The gate opens 2026-10-07. Bypassing a supply-chain control with--no-time-gatewas not a good trade for a dev-only DoS that cannot reach a server — this repo ships static files and has no CSS. It will be a separate one-line follow-up.AI disclosure
Per CONTRIBUTING.md § Coding with AI: this PR was produced with Claude Code. The dependency analysis, the
resolutionsentry, the commit message and this description were AI-assisted. The scope is one line ofpackage.jsonplus the resultingyarn.lockdelta; all claims above were verified against the installed sources and the three commands listed under Verification, and reviewed before submitting.🤖 Generated with Claude Code
Summary by CodeRabbit