Description
mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true.
Published: 2026-09-24
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Prototype pollution capable of injecting arbitrary properties into Object.prototype, enabling potential code execution and local file disclosure when converting DOCX to HTML
Action: Immediate Patch
AI Analysis

Impact

mammoth.js before version 1.12.2 reads style information from a DOCX document, and a crafted file can cause the library to add properties to Object.prototype. This prototype pollution allows an attacker to influence subsequent JavaScript execution within the same process and, if certain features are enabled, expose local server files via the externalFileAccess option. The weakness is a classic example of insecure prototype manipulation (CWE-1321).

Affected Systems

The vulnerability affects the mwilliamson mammoth.js library for all releases prior to 1.12.2. Versions 1.11.0 through 1.12.1 additionally expose local file contents when the externalFileAccess option is true during document conversion.

Risk and Exploitability

With a CVSS score of 8.4 the vulnerability is considered high severity. The EPSS score is currently unavailable, but the lack of listing in the CISA KEV catalog does not diminish the risk. The attack vector is likely to involve an attacker supplying a malicious DOCX to an application that processes files in the same runtime and returns HTML, enabling data leakage or arbitrary code execution.

Generated by OpenCVE AI on September 24, 2026 at 05:20 UTC.

Remediation

Vendor Solution

Upgrade to mammoth 1.12.2 or later.

OpenCVE Recommended Actions

  • Upgrade mammoth to version 1.12.2 or later
  • Disable the externalFileAccess option unless it is required that your use case
  • Run document conversions in isolated/short‑lived processes to prevent prototype pollution from affecting subsequent workloads

Generated by OpenCVE AI on September 24, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Mwilliamson
Mwilliamson mammoth.js
Vendors & Products Mwilliamson
Mwilliamson mammoth.js

Thu, 24 Sep 2026 05:45:00 +0000

Type Values Removed Values Added
Title Prototype Pollution in mammoth.js via Malicious DOCX

Thu, 24 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Description mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true.
Weaknesses CWE-1321
References
Metrics cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Mwilliamson Mammoth.js
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-24T13:02:42.611Z

Reserved: 2026-09-24T03:08:15.164Z

Link: CVE-2026-97151

cve-icon Vulnrichment

Updated: 2026-09-24T13:02:35.415Z

cve-icon NVD

Status : Received

Published: 2026-09-24T04:18:06.027

Modified: 2026-09-24T13:17:18.920

Link: CVE-2026-97151

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T09:08:51Z

Weaknesses
  • CWE-1321

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')