Vulnerability Description
mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true.
Related Weaknesses (CWE)
References
- https://github.com/mwilliamson/mammoth.js/commit/2888fa158d67c1419199f152326e12a
- https://github.com/mwilliamson/mammoth.js/commit/31f0c370be4b95ac4fa285fea3be970
- https://raw.githubusercontent.com/mwilliamson/mammoth.js/master/NEWS
- https://www.npmjs.com/package/mammoth
FAQ
What is CVE-2026-97151?
CVE-2026-97151 is a documented vulnerability. mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary propertie...
How severe is CVE-2026-97151?
CVSS scoring is not yet available for CVE-2026-97151. Check NVD for updates.
Is there a patch for CVE-2026-97151?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.