60 matches found
CVE-2026-93405
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...
CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...
CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...
CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)
Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...
CVE-2026-93405
The Mailspring email client is vulnerable to Stored XSS in the attachment quick preview feature in versions prior to 1.17.0 . The application fails to sanitize HTML generated from Markdown, DOCX, and XLSX attachments converted via Snarkdown, Mammoth, and SheetJS, inserting the result into the pre...
CVE-2026-97151
mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...
Prototype Pollution
Overview mammoth is a Convert Word documents from docx to simple HTML and Markdown Affected versions of this package are vulnerable to Prototype Pollution via the readStylesXml function in lib/docx/styles-reader.js when processing a document's embedded styles. The function previously used a plain...
CVE-2026-97151
The mammoth (aka mammoth.js) library before version 1.12.2 is vulnerable to prototype pollution when processing styles defined in a document. By converting a crafted .docx file, an attacker can add arbitrary properties to Object.prototype . Additionally, in versions 1.11.0 through 1.12.1 , applic...
EUVD-2026-85782
mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...
CVE-2026-97151
mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...
CVE-2026-97151
mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...
CVE-2026-97151
mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...
CVE-2026-97151: Improperly Controlled Modification of Object Prototype Attributes
mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...
PT-2026-97698
Name of the Vulnerable Software and Affected Versions mammoth versions prior to 1.12.2 Description The software is susceptible to prototype pollution when reading styles defined in a document. An attacker can add arbitrary properties to Object.prototype by converting a specially crafted .docx fil...
PT-2026-98230
Name of the Vulnerable Software and Affected Versions Mailspring versions prior to 1.17.0 Description The attachment quick preview feature converts Markdown, DOCX, and XLSX attachments using Snarkdown, Mammoth, and SheetJS, then inserts the resulting HTML into the preview document via innerHTML...
Mammoth is vulnerable to Directory Traversal
Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of...
PYSEC-2026-1603 Mammoth is vulnerable to Directory Traversal
Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of...
Directory Traversal
Mammoth is vulnerable to Directory Traversal. The vulnerability is due to the lack of path or file type validation when processing DOCX files with externally linked images, which allows an attacker to read arbitrary files on the system or trigger excessive resource consumption by referencing...