Homepage

mammoth@1.9.0 vulnerabilities

Convert Word documents from docx to simple and clean HTML and Markdown

  • latest version

    1.11.0

  • latest non vulnerable version

    1.11.0

  • first published

    11 years ago

  • latest version published

    1 months ago

  • licenses detected

  • View mammoth package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the mammoth package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Directory Traversal

    Affected versions of this package are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero.

    How to fix Directory Traversal?

    Upgrade mammoth to version 1.11.0 or higher.

    [0.3.25,1.11.0)
    Go back to all versions of this package