Listen to this Post
The vulnerability exists in the `lib/input.js` file within the Formatter Handler component. It arises from improper sanitization of user input that is passed to object modification functions. An attacker can craft a malicious payload that, when processed by the affected function, triggers a prototype pollution attack. This allows the attacker to inject properties into the base JavaScript Object.prototype. Remote exploitation is possible but requires the parent Node.js application to already have a similar security flaw, as the attack leverages this pre-existing condition. The pollution can alter the application’s behavior globally, potentially leading to denial-of-service or, in conjunction with other flaws, code execution. The high complexity and difficult exploitability stem from this necessary chained condition.
Platform: Carbone
Version: <= fbcd3490
Vulnerability: Prototype Pollution
Severity: Low
date: 2026-01-07
Prediction: Patch: 2026-01-14
What Undercode Say:
Analytics
grep -r "lib/input.js" node_modules/carbone npm list carbone curl -s https://raw.githubusercontent.com/carboneio/carbone/fbcd349077ad0e8748be73eab2a82ea92b6f8a7e/lib/input.js | head -50
How Exploit:
// Example pollution payload targeting formatter
const maliciousPayload = {
"<strong>proto</strong>": {
"polluted": "true"
}
};
// This payload would need to be processed by the vulnerable input handler.
Protection from this CVE
Upgrade to v3.5.6.
Audit application for prototype pollution.
Implement input validation/sanitization.
Impact:
Modifies object prototypes.
Potential DoS or logic corruption.
Requires chained vulnerability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
