CVE-2026-97151: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mwilliamson mammoth.js
mammoth.js versions before 1.12.2 are vulnerable to prototype pollution via crafted .docx files. This vulnerability allows attackers to add arbitrary properties to Object.prototype when reading document styles. Additionally, versions 1.11.0 through 1.12.1 can disclose local server file contents if externalFileAccess is set to true during document conversion in the same process.
AI Analysis
Technical Summary
CVE-2026-97151 describes a prototype pollution vulnerability in mammoth.js prior to version 1.12.2. The flaw arises when processing styles from a crafted .docx file, enabling an attacker to modify Object.prototype with arbitrary properties. In versions 1.11.0 through 1.12.1, if the externalFileAccess option is enabled, an attacker supplying documents can cause disclosure of local server files during subsequent document conversions in the same process.
Potential Impact
An attacker can exploit this vulnerability to perform prototype pollution, potentially leading to unexpected behavior or security bypasses in applications using mammoth.js. Furthermore, in certain versions with externalFileAccess enabled, sensitive local server files may be disclosed to the attacker. The CVSS 4.0 score of 8.4 reflects a high severity due to network attack vector, no user interaction, and high impact on confidentiality and availability.
Mitigation Recommendations
Upgrade mammoth.js to version 1.12.2 or later, where this vulnerability is fixed. If upgrading is not immediately possible, ensure that the externalFileAccess option is not enabled (set to false) to prevent local file disclosure. No other vendor advisory or patch information is provided; therefore, check the official mammoth.js repository or vendor advisories for the latest remediation guidance.
CVE-2026-97151: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mwilliamson mammoth.js
Description
mammoth.js versions before 1.12.2 are vulnerable to prototype pollution via crafted .docx files. This vulnerability allows attackers to add arbitrary properties to Object.prototype when reading document styles. Additionally, versions 1.11.0 through 1.12.1 can disclose local server file contents if externalFileAccess is set to true during document conversion in the same process.
CVSS v4.0
Score 8.4high
Affected software
mwilliamson
mammoth.js
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-97151 describes a prototype pollution vulnerability in mammoth.js prior to version 1.12.2. The flaw arises when processing styles from a crafted .docx file, enabling an attacker to modify Object.prototype with arbitrary properties. In versions 1.11.0 through 1.12.1, if the externalFileAccess option is enabled, an attacker supplying documents can cause disclosure of local server files during subsequent document conversions in the same process.
Potential Impact
An attacker can exploit this vulnerability to perform prototype pollution, potentially leading to unexpected behavior or security bypasses in applications using mammoth.js. Furthermore, in certain versions with externalFileAccess enabled, sensitive local server files may be disclosed to the attacker. The CVSS 4.0 score of 8.4 reflects a high severity due to network attack vector, no user interaction, and high impact on confidentiality and availability.
Mitigation Recommendations
Upgrade mammoth.js to version 1.12.2 or later, where this vulnerability is fixed. If upgrading is not immediately possible, ensure that the externalFileAccess option is not enabled (set to false) to prevent local file disclosure. No other vendor advisory or patch information is provided; therefore, check the official mammoth.js repository or vendor advisories for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-09-24T03:08:15.164Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab499fef7a7c54106c9f5b9
Added to database: 09/24/2026, 03:33:18 UTC
Last enriched: 09/24/2026, 03:47:39 UTC
Last updated: 09/24/2026, 04:05:42 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.