CVE-2024-14020

@@ -1,4 +1,7 @@
 
+### v3.5.6
+  - Security fix: Removed the possibility of prototype pollution in formatters. This can only occur if the parent NodeJS application has the same security issue. CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
+
 ### v3.5.5
   - Release February 15th 2023
   - Bump dependencies

@@ -2,7 +2,7 @@ const params = require('./params');
 const format = require('./format');
 const parser = require('./parser');
 const locale = require('../formatters/_locale.js');
-const formatters = {};
+const formatters = Object.create(null); // Remove  __proto__ and constructor attributes. Mitigates prototype pollution attacks.
 
 /**
  * Parse options coming from user-side. Clean it and generate a safe options object for internal use

@@ -252,6 +252,20 @@ describe('Carbone', function () {
       assert.notEqual(typeof input.formatters.yesOrNo, 'undefined');
       assert.equal(input.formatters.yesOrNo(true), 'yes');
     });
+    it('should not be able to inject code with prototype pollution of formatters', function (done) {
+      const _injectedCode = 'a;process.exit.call`-1`;//';
+      new Object()['__proto__'][_injectedCode] = 1;
+      Object.defineProperty(new Object()['__proto__'], _injectedCode, {
+        enumerable:false, // otherwhise it crashes elsewhere in the code (each time there is a loop on object)
+      });
+      const _xml = '<xml> {d.age:'+_injectedCode+'(3)} </xml>';
+      const _data = { age : '1' };
+      carbone.renderXML(_xml, _data, function (err, result) {
+        helper.assert(err+'', 'Error: Formatter \"a;process.exit.call`-1`;//\" does not exist. Do you mean \"and\"?');
+        helper.assert(result, null);
+        done();
+      });
+    });
   });