CVE-2026-97151CWE-1321

CVE-2026-97151

published September 24, 2026

CVSS
8.4
EPSS
0%
Percentile
28.0
In the wild
Unconfirmed
What it is

mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true.

The record
Technical detail
CVSS
8.4 · NONE
CVSS v4.0
8.4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
EPSS
0.00355 · 28.0th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2026-09-24T08:18Z
References (4)
https://github.com/mwilliamson/mammoth.js/commit/2888fa158d67c1419199f152326e12a05618b53e · [email protected]https://github.com/mwilliamson/mammoth.js/commit/31f0c370be4b95ac4fa285fea3be970606735f16 · [email protected]https://raw.githubusercontent.com/mwilliamson/mammoth.js/master/NEWS · [email protected]https://www.npmjs.com/package/mammoth · [email protected]
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 24 SEP 03:08Z
    mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document
    cvelistv5