CVE-2026-97151
High
Description
mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true.
SeverityHigh
CVSS8.4
Exploit probability—
ProductMwilliamson Mammoth.js
PublishedSep 24, 2026
First seenSep 24, 2026
Weakness typeCWE-1321Prototype pollution
How to fix
Update
- mwilliamson mammoth.js1.12.2 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mwilliamson mammoth.js | v < 1.12.2 | 1.12.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.