Read the docs
TI-2024-13016 Aliases CVE-2024-14020GHSA-6rcw-ww3x-xqwm

carboneio carbone Formatter input.js prototype pollution

Priority LOW 12CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the file lib/input.js of the component Formatter Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. Upgrading to version 3.5.6 will fix this issue. This patch is called 04f9feb24bfca23567706392f9ad2c53bbe4134e. You should upgrade the affected component. A successful exploitation can "only occur if the parent NodeJS application has the same security issue".

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00306 23rd percentileScored 2026-11-07
Fix Fixed carbone (carboneio): 3.5.6carbone (npm): 3.5.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
carboneiocarbonefbcd349077ad0e8748be73eab2a82ea92b6f8a7e3.5.6Patch availableCNA
—carbone (npm)before 3.5.63.5.6Patch availableGHSA-6rcw-ww3x-xqwm
  • carbone Vendorcarboneio Affected fbcd349077ad0e8748be73eab2a82ea92b6f8a7e Fixed in 3.5.6 Patch available CNA
  • carbone (npm) Vendor— Affected before 3.5.6 Fixed in 3.5.6 Patch available GHSA-6rcw-ww3x-xqwm

Remediation

  • Fix · CNA carbone (carboneio) Fixed in 3.5.6
  • Fix · GHSA-6rcw-ww3x-xqwm carbone (npm) Fixed in 3.5.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-14020
  2. 2026-10-03 Alias added: GHSA-6rcw-ww3x-xqwm

References

Patch 2

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences