Threat database

Mammoth.js versions from 1.3.0 up to but not including 1.12.3 contain a regular expression denial of service (ReDoS) vulnerability in the style map tokeniser. This vulnerability arises from overlapping regex alternatives in the tokeniser code, allowing an attacker to supply a crafted .docx file with an unterminated quoted string of repeated backslash escapes. This can block the Node.js event loop, causing a denial of service condition. The vulnerability has a high severity score of 8.7 CVSS 4.0 and does not require user interaction or privileges to exploit.

mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true.