CVE-2026-97151: High severity npm/mammoth vulnerability
mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mammothto a version that resolves this vulnerability.Fixed in 1.12.2
Event History
Frequently Asked Questions
Which deployments are exposed to the local-file disclosure behavior?
The disclosure behavior applies to applications using mammoth versions 1.11.0 through 1.12.1 that convert additional documents in the same process and return the converted HTML to the party supplying documents. It requires externalFileAccess to be set to true.
What does an attacker need to provide to trigger the issue?
An attacker needs to supply a crafted .docx file for conversion. The crafted document can pollute Object.prototype through styles defined in the document.
Are applications using the default external-file setting affected by the file-disclosure scenario?
The described file-disclosure scenario specifically requires externalFileAccess to be true. The prototype-pollution issue is triggered by reading styles from a crafted document and is described as affecting versions before 1.12.2.
What version resolves the vulnerability?
Upgrade mammoth to version 1.12.2 or later. Versions before 1.12.2 are described as vulnerable to prototype pollution.