Executive brief
Carbone is a popular document generation library used to create PDFs and other formatted outputs from templates. A code injection vulnerability in its formatter component could allow an authenticated attacker to manipulate object properties and potentially execute unintended code, but only if the parent application using Carbone has a related security issue. The impact is limited and requires high attack complexity.
Technical details
The vulnerability is a code injection flaw (CWE-94) affecting the Formatter Handler in lib/input.js of Carbone versions prior to 3.5.6. The issue involves improper control of object prototype attributes (prototype pollution), allowing an attacker to manipulate the object prototype chain. Exploitation requires network access, authentication (PR:L), and is characterized by high complexity (AC:H). A successful exploit can lead to confidentiality, integrity, and availability impacts, but only if the parent Node.js application has the same security vulnerability. The patch (commit 04f9feb) removes the possibility of prototype pollution in formatters and has been released in version 3.5.6.
Affected products
- Carbone Carbone prior to 3.5.6
Timeline
- 2026-01-07: disclosed
- 2026-01-07: patched: Version 3.5.6 released with fix