Regular Expression Denial of Service (ReDoS)

Overview mammoth is a Convert Word documents from docx to simple HTML and Markdown Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supp...

@5ss/ai-tools (>=2.11.1, <=2.11.3), @aem-screens/franklin-variation-creator (1.0.0-B001) +260 more potentially affected by CVE-2026-105219 via mammoth (>=1.3.6, <=1.12.2)

mammoth NPM version =1.3.6, =2.11.1, =0.9.1, =3.4.1, =0.0.1, =1.0.0, =0.5.5, =0.0.9, =0.1.5, =1.1.0, =1.2.1, =0.1.13, =0.1.14 - @catmasks/free-editor 1.0.1 and more Source cves: CVE-2026-105219 Source advisory: SNYK:JS-MAMMOTH-20510281...

@5ss/ai-tools (>=2.11.1, <=2.11.3), @aem-screens/franklin-variation-creator (1.0.0-B001) +260 more potentially affected by CVE-2026-105219 via mammoth (>=1.3.6, <=1.12.2)

mammoth NPM version =1.3.6, =2.11.1, =0.9.1, =3.4.1, =0.0.1, =1.0.0, =0.5.5, =0.0.9, =0.1.5, =1.1.0, =1.2.1, =0.1.13, =0.1.14 - @catmasks/free-editor 1.0.1 and more Source cves: CVE-2026-105219 Source advisory: MEND:CVE-2026-105219...

CVE-2026-93405

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

CVE-2026-93405

The Mailspring email client is vulnerable to Stored XSS in the attachment quick preview feature in versions prior to 1.17.0 . The application fails to sanitize HTML generated from Markdown, DOCX, and XLSX attachments converted via Snarkdown, Mammoth, and SheetJS, inserting the result into the pre...

CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

CVE-2026-97151

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

@5ss/ai-tools (>=2.11.1, <=2.11.3), @agentmug/cli (>=0.9.1, <=0.10.1) +78 more potentially affected by CVE-2026-97151 via mammoth (>=1.11.0, <=1.12.1)

mammoth NPM version =1.11.0, =2.11.1, =0.9.1, =0.5.5, =1.1.0, =0.1.13, =1.9.5, =0.1.0, =0.1.0, =0.17.4, =0.2.0-beta.1, =2.11.0, =2.11.1 and more Source cves: CVE-2026-97151 Source advisory: SNYK:JS-MAMMOTH-20074633...

Prototype Pollution

Overview mammoth is a Convert Word documents from docx to simple HTML and Markdown Affected versions of this package are vulnerable to Prototype Pollution via the readStylesXml function in lib/docx/styles-reader.js when processing a document's embedded styles. The function previously used a plain...

CVE-2026-97151

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

@5ss/ai-tools (>=2.11.1, <=2.11.3), @aem-screens/franklin-variation-creator (1.0.0-B001) +252 more potentially affected by CVE-2026-97151 via mammoth (>=1.3.6, <=1.12.1)

mammoth NPM version =1.3.6, =2.11.1, =0.9.1, =3.4.1, =0.0.1, =1.0.0, =0.5.5, =0.0.9, =0.1.5, =1.1.0, =1.2.1, =0.1.13, =0.1.14 - @catmasks/free-editor 1.0.1 and more Source cves: CVE-2026-97151 Source advisory: MEND:CVE-2026-97151...

CVE-2026-97151

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

CVE-2026-97151

The mammoth (aka mammoth.js) library before version 1.12.2 is vulnerable to prototype pollution when processing styles defined in a document. By converting a crafted .docx file, an attacker can add arbitrary properties to Object.prototype . Additionally, in versions 1.11.0 through 1.12.1 , applic...

EUVD-2026-85782

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

CVE-2026-97151

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

CVE-2026-97151: Improperly Controlled Modification of Object Prototype Attributes

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

PT-2026-97698

Name of the Vulnerable Software and Affected Versions mammoth versions prior to 1.12.2 Description The software is susceptible to prototype pollution when reading styles defined in a document. An attacker can add arbitrary properties to Object.prototype by converting a specially crafted .docx fil...

PT-2026-98230

Name of the Vulnerable Software and Affected Versions Mailspring versions prior to 1.17.0 Description The attachment quick preview feature converts Markdown, DOCX, and XLSX attachments using Snarkdown, Mammoth, and SheetJS, then inserts the resulting HTML into the preview document via innerHTML...