CVE-2024-14020

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-14020
A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the file lib/input.js of the component Formatter Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. Upgrading to version 3.5.6 will fix this issue. This patch is called 04f9feb24bfca23567706392f9ad2c53bbe4134e. You should upgrade the affected component. A successful exploitation can "only occur if the parent NodeJS application has the same security issue".

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.6 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:H/Au:S/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/carboneio/carbone/
https://github.com/carboneio/carbone/commit/04f9feb24bfca23567706392f9ad2c53bbe4134e
https://github.com/carboneio/carbone/releases/tag/3.5.6
https://vuldb.com/?ctiid.339503
https://vuldb.com/?id.339503
Configurations

No configuration.

History

15 Apr 2026, 00:35

Type Values Removed Values Added
Summary
  • (es) Se ha identificado una debilidad en carboneio carbone hasta fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. Esto afecta a una función desconocida del archivo lib/input.js del componente Formatter Handler. La ejecución de una manipulación puede conducir a una modificación indebidamente controlada de atributos de prototipo de objeto. El ataque puede lanzarse de forma remota. Este ataque se caracteriza por alta complejidad. Se dice que la explotabilidad es difícil. La actualización a la versión 3.5.6 solucionará este problema. Este parche se llama 04f9feb24bfca23567706392f9ad2c53bbe4134e. Debería actualizar el componente afectado. Una explotación exitosa 'solo puede ocurrir si la aplicación padre de NodeJS tiene el mismo problema de seguridad'.

23 Feb 2026, 09:16

Type Values Removed Values Added
References
  • () https://github.com/carboneio/carbone/ -

07 Jan 2026, 12:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-07 12:16

Updated : 2026-04-15 00:35

NVD link : CVE-2024-14020

Mitre link : CVE-2024-14020

CVE.ORG link : CVE-2024-14020

JSON object : View

Products Affected

No product.

CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')