EUVD-2026-85782
GHSA-89qm-22qm-xf5h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated crafted-doc supply (PR:N/UI:N); AC:H because the high-impact file disclosure needs the 1.11.0-1.12.1 window plus same-process reuse and HTML return; C:H for local file read, I:L/A:L from prototype pollution.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true.
Articles & Coverage 1
AnalysisAI
Converting an attacker-supplied .docx file with mammoth.js before 1.12.2 allows unauthenticated remote attackers to inject arbitrary properties into Object.prototype via the document's style definitions (CWE-1321 prototype pollution). In versions 1.11.0 through 1.12.1 the pollution can additionally be leveraged to read local server files and disclose them to the document supplier, but only where the application converts further documents in the same long-lived Node.js process and returns the converted HTML back to that party. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The prototype-pollution primitive (all versions before 1.12.2) requires only that the application convert an attacker-supplied .docx containing a style element with w:type set to '__proto__' - no authentication or user interaction on the victim side. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H, 8.4 High) marks this as network-reachable and unauthenticated, but the AT:P (attack requirements present) metric is the key qualifier: the high-confidentiality outcome (local file disclosure) is not universal - it requires versions 1.11.0-1.12.1 specifically AND an application architecture that converts multiple documents in the same long-lived process and returns the rendered HTML to the document supplier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to mammoth.js 1.12.2 (npm install mammoth@1.12.2), which replaces the vulnerable style-type object lookup with an explicit switch statement and blocks the "__proto__" key path entirely; the fix is documented in the project NEWS file (referenced from the advisory at https://raw.githubusercontent.com/mwilliamson/mammoth.js/master/NEWS) and in upstream commits 31f0c370be4b95ac4fa285fea3be970606735f16 and 2888fa158d67c1419199f152326e12a05618b53e. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems and services using mammoth.js and determine whether they run affected versions before 1.12.2, prioritizing any long-lived Node.js processes that convert user-supplied .docx files and return HTML to requesters; apply the vendor-released patch by upgrading to mammoth.js 1.12.2 or later immediately where feasible, and if immediate upgrade is not possible, isolate or disable document conversion for untrusted files and restrict outbound data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today