CVE-2026-97151
- State
- Published
- Severity
- 8.4 High
- Published
- Sep 24, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 24, 2026
Description
mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N | mitre |
Weaknesses
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected Products
| Product | Versions |
|---|---|
mammoth.jsmwilliamson |
|
References
- https://raw.githubusercontent.com/mwilliamson/mammoth.js/master/NEWSrelease-notesvendor-advisory
- https://www.npmjs.com/package/mammothproduct
- https://github.com/mwilliamson/mammoth.js/commit/31f0c370be4b95ac4fa285fea3be970606735f16patch
- https://github.com/mwilliamson/mammoth.js/commit/2888fa158d67c1419199f152326e12a05618b53epatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.