CVE-2026-97151
2026-09-24
04h18 +00:00
04h18 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Improperly Controlled Modification of Object Prototype Attributes The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. |
