A high-severity prototype pollution vulnerability in mammoth.js allows unauthenticated attackers to manipulate object properties and potentially disclose sensitive local server files.

The library is susceptible to prototype pollution when parsing styles within .docx documents. An unauthenticated attacker can supply a malicious file to modify Object.prototype, which may lead to local file disclosure if the application performs multiple conversions within the same process.

The exploitation of this vulnerability poses a significant risk to data confidentiality and application integrity. By polluting the object prototype, an attacker may manipulate application logic or successfully read local files from the server, potentially exposing credentials, configuration files, or sensitive internal data. With a CVSS score of 8.4, this flaw is categorized as high severity and requires immediate attention to prevent unauthorized information disclosure.

Immediate Action: Upgrade the mammoth.js package to version 1.12.2 or later to include the necessary security patches.

Proactive Monitoring: Monitor application logs for unexpected file access errors or unusual document processing behavior that might indicate an attempt to trigger the prototype pollution flaw.

Compensating Controls: Implement strict input validation or sandboxing for uploaded .docx files to limit the potential impact of file parsing vulnerabilities if immediate patching is not feasible.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability represents a significant risk to the confidentiality of server-side data. Given the potential for local file disclosure, administrators must prioritize updating mammoth.js to version 1.12.2 or later. Ensure that all downstream dependencies are also validated after the update to maintain a secure application state.