The vulnerability in CartoDB carto-api-client 0.5.29 arises from insufficient validation or control over the column argument passed to the addFilter function in src/filters.ts. This allows an attacker to improperly modify object prototype attributes, which can lead to unexpected behavior or security issues. The attack vector is remote, requiring no user interaction, and the vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity. There is currently no known exploit in the wild and no official fix or mitigation from the vendor.

An attacker can remotely manipulate the column argument to the addFilter function, leading to improper modification of object prototype attributes. This may cause security issues such as prototype pollution, potentially affecting application logic or security controls relying on object prototypes. The exact impact depends on how the affected application uses the carto-api-client library.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should monitor for updates from CartoDB. Until a fix is released, consider applying additional input validation or sandboxing measures around usage of the addFilter function if feasible.