Threats tagged 'ghsa-fp33-4hh4-xjj5'

Mammoth.js versions from 1.3.0 up to but not including 1.12.3 contain a regular expression denial of service (ReDoS) vulnerability in the style map tokeniser. This vulnerability arises from overlapping regex alternatives in the tokeniser code, allowing an attacker to supply a crafted .docx file with an unterminated quoted string of repeated backslash escapes. This can block the Node.js event loop, causing a denial of service condition. The vulnerability has a high severity score of 8.7 CVSS 4.0 and does not require user interaction or privileges to exploit.