EUVD-2025-84792

Malicious code in mammothwildebeestz3n npm...

EUVD-2025-53370

Malicious code in mammoth-black-canid npm...

EUVD-2025-53369

Malicious code in mammoth-lime-halibut npm...

EUVD-2025-53368

Malicious code in mammoth-turquoise-weasel npm...

EUVD-2025-53371

Malicious code in mammoth-amethyst-yak npm...

MAL-2025-69279 Malicious code in mammoth-black-canid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ced992abcfcc4fdc1051e69c55193333e19e613d56906644478124a80b30c41 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-49862

Malicious code in mammothgopherz3n npm...

CVE-2025-11849

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of...

EUVD-2025-34861

Mammoth is vulnerable to Directory Traversal...

Mammoth is vulnerable to Directory Traversal

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of...

@cognigy/cognigy-cli (>=1.9.1 <=1.9.4), @iharkharytanovich/found (>=0.1.1 <=0.1.4) +2 more potentially affected by CVE-2025-11849 via mammoth (>=0.3.33 <=1.10.0)

mammoth NPM version =0.3.33, =1.9.1, =0.1.1, =1.0.0, =1.0.4 - youseeu =1.0.0 Source cves: CVE-2025-11849 Source advisory: OSV:GHSA-RMJR-87WV-GF87...

GHSA-RMJR-87WV-GF87 Mammoth is vulnerable to Directory Traversal

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of...

CVE-2025-11849

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of...

CVE-2025-11849

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of...

CVE-2025-11849

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of...

CVE-2025-11849

The CVE-2025-11849 entry affects Mammoth (org.zwobble.mammoth:mammoth) and the Mammoth package family up to version 1.11.0 (pre-1.11.0). The root cause is a lack of path or file-type validation when processing DOCX files containing externally linked images (r:link) instead of embedded r:embed. Th...

CVE-2025-11849

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of...

Mammoth 安全漏洞

Mammoth is a tool for converting Word documents to HTML by the individual developer Michael Williamson. A security vulnerability exists in mammoth version 0.3.25 and versions prior to 1.11.0, which stems from a lack of path or file type validation when processing docx files, and could lead to a...

@cognigy/cognigy-cli (>=1.9.1 <=1.9.4), @iharkharytanovich/found (>=0.1.1 <=0.1.4) +2 more potentially affected by CVE-2025-11849 via mammoth (>=0.3.33 <=1.10.0)

mammoth NPM version =0.3.33, =1.9.1, =0.1.1, =1.0.0, =1.0.4 - youseeu =1.0.0 Source cves: CVE-2025-11849 Source advisory: SNYK:JS-MAMMOTH-13554470...

Directory Traversal

Overview mammoth is a Convert Word documents from docx to simple HTML and Markdown Affected versions of this package are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link r:link attribute instead...