CVE-2026-97151

— UNSCOREDpublic exploit available

Published 2026-09-24 · Updated 2026-09-24

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true.

Weaknesses

CWE-1321

Public exploit & PoC references

https://github.com/mwilliamson/mammoth.js/commit/2888fa158d67c1419199f152326e12a05618b53e
https://github.com/mwilliamson/mammoth.js/commit/31f0c370be4b95ac4fa285fea3be970606735f16

All references

https://github.com/mwilliamson/mammoth.js/commit/2888fa158d67c1419199f152326e12a05618b53e
https://github.com/mwilliamson/mammoth.js/commit/31f0c370be4b95ac4fa285fea3be970606735f16
https://raw.githubusercontent.com/mwilliamson/mammoth.js/master/NEWS
https://www.npmjs.com/package/mammoth

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-101900PoC
UNSCOREDCVE-2026-101902PoC
UNSCOREDCVE-2026-101904PoC
UNSCOREDCVE-2026-101905PoC
UNSCOREDCVE-2026-101908PoC
UNSCOREDCVE-2026-101909PoC
MEDIUMCVE-2026-14574PoC
MEDIUMCVE-2026-61834PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.