CVE-2026-97151mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document.
Updated under an hour ago ()
Does this affect you?
It affects mwilliamson mammoth.js. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true.
- CVSS
- 8.4 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-1321
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mitre
- NVD analysis
- Awaiting Analysis
- Record last updated
- Sep 24, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
mwilliamson mammoth.js mwilliamson:mammoth.js (from the name) | before 1.12.2 | CNA record |
References
- https://raw.githubusercontent.com/mwilliamson/mammoth.js/master/NEWSrelease-notes, vendor-advisory
- https://www.npmjs.com/package/mammothproduct
- https://github.com/mwilliamson/mammoth.js/commit/31f0c370be4b95ac4fa285fea3be970606735f16patch
- https://github.com/mwilliamson/mammoth.js/commit/2888fa158d67c1419199f152326e12a05618b53epatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.