Prototype Pollution Vulnerability in Mammoth.js

CVE-2026-97151

What is CVE-2026-97151?

The Mammoth.js library, specifically versions prior to 1.12.2, is vulnerable to prototype pollution. This vulnerability arises when the library reads styles from crafted .docx files, allowing attackers to introduce arbitrary properties into Object.prototype. Additionally, in versions 1.11.0 through 1.12.1, if externalFileAccess is enabled, attackers can potentially expose the contents of local server files when converting documents in the same process. This presents significant security risks for applications relying on Mammoth.js for document conversion.

References