CVE-2026-97151

The mammoth (aka mammoth.js) library before version 1.12.2 is vulnerable to prototype pollution when processing styles defined in a document. By converting a crafted .docx file, an attacker can add arbitrary properties to Object.prototype . Additionally, in versions 1.11.0 through 1.12.1 , applic...