PT-2026-1548 · Carbon · Carbon

Published 2026-01-07 · Updated 2026-01-07 · CVE-2024-14020

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions carboneio carbone versions prior to 3.5.6

Description A weakness exists in carboneio carbone up to version fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. The issue resides in the Formatter Handler component, specifically within the file lib/input.js and an unknown function. A manipulation can lead to improperly controlled modification of object prototype attributes. This attack can be launched remotely and is characterized by high complexity, with difficult exploitability. Successful exploitation may only occur if the parent NodeJS application has the same security issue.

Recommendations Upgrade to version 3.5.6 or later.

Fix

Prototype Pollution

Code Injection

Weakness Enumeration

CWE-1321

CWE-94

Related Identifiers

CVE-2024-14020

GHSA-6RCW-WW3X-XQWM

Affected Products

Carbon

References · 10

• https://github.com/carboneio/carbone/releases/tag/3.5.6 · Patch
• https://github.com/carboneio/carbone/commit/04f9feb24bfca23567706392f9ad2c53bbe4134e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-14020 · Security Note
• https://osv.dev/vulnerability/GHSA-6rcw-ww3x-xqwm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-14020 · Vendor Advisory
• https://github.com/carboneio/carbone · Note
• https://vuldb.com/?ctiid.339503 · Note
• https://twitter.com/CVEnew/status/2008771288689729620 · Twitter Post
• https://vuldb.com/?id.339503 · Note
• https://t.me/CVEtracker/41551 · Telegram Post