{"vulnerability": "CVE-2026-104848", "sightings": [{"uuid": "045ce99c-e5f7-4765-8710-10e558b4efae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104848", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwvxoem7lf2x", "content": "\ud83d\udea8 CVE-2026-104848 \u2014 CVSS 9.5 CRITICAL\n\nTinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs Thread...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-104848\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-02T18:07:44.402697Z"}, {"uuid": "29379521-b105-479a-b5c9-537f3ef2dcb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104848", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mwvzhpba762b", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-104848: Tinypool is a minimal Node.js worker thread pool implementation\nCVSS 9.5\nhttps://beta.vulnsea.com/cve/CVE-2026-104848\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-10-02T18:39:48.429159Z"}, {"uuid": "f51ed122-f054-46ac-8f2c-c27e10664e12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-104848", "type": "published-proof-of-concept", "source": "https://github.com/tinylibs/tinypool/security/advisories/GHSA-5gmw-xhrv-c9v3", "content": "", "creation_timestamp": "2026-08-30T05:32:48.000000Z"}, {"uuid": "f845994d-7f4a-4497-9dbc-ebd75c793ba1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104848", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxc4pxx5l72r", "content": "CVE-2026-104848 - tinypool\nThe tinypool library used to manage Node.js worker threads can be tricked into loading any script an attacker supplies. By adding malicious values to the default object\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#tinypool #tinylibs #npm #CVE #infosec", "creation_timestamp": "2026-10-07T14:10:04.250842Z"}]}