Mammoth Js
Monthly
Regular expression denial of service in mammoth.js 1.3.0 through 1.12.2 lets unauthenticated remote attackers stall the Node.js event loop by feeding a crafted .docx whose embedded style map contains an unterminated single-quoted string built from repeated backslash escape sequences. The flaw lives in the style-map tokeniser and triggers catastrophic regex backtracking, so any service that converts untrusted documents to HTML becomes trivially exhaustible, though exploitation is only realistic when the style map is drawn from attacker-supplied document content rather than static developer configuration. A vendor patch is available in 1.12.3; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Converting an attacker-supplied .docx file with mammoth.js before 1.12.2 allows unauthenticated remote attackers to inject arbitrary properties into Object.prototype via the document's style definitions (CWE-1321 prototype pollution). In versions 1.11.0 through 1.12.1 the pollution can additionally be leveraged to read local server files and disclose them to the document supplier, but only where the application converts further documents in the same long-lived Node.js process and returns the converted HTML back to that party. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; vendor-released patch: 1.12.2.
Regular expression denial of service in mammoth.js 1.3.0 through 1.12.2 lets unauthenticated remote attackers stall the Node.js event loop by feeding a crafted .docx whose embedded style map contains an unterminated single-quoted string built from repeated backslash escape sequences. The flaw lives in the style-map tokeniser and triggers catastrophic regex backtracking, so any service that converts untrusted documents to HTML becomes trivially exhaustible, though exploitation is only realistic when the style map is drawn from attacker-supplied document content rather than static developer configuration. A vendor patch is available in 1.12.3; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Converting an attacker-supplied .docx file with mammoth.js before 1.12.2 allows unauthenticated remote attackers to inject arbitrary properties into Object.prototype via the document's style definitions (CWE-1321 prototype pollution). In versions 1.11.0 through 1.12.1 the pollution can additionally be leveraged to read local server files and disclose them to the document supplier, but only where the application converts further documents in the same long-lived Node.js process and returns the converted HTML back to that party. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; vendor-released patch: 1.12.2.