Mammoth is vulnerable to Directory Traversal

Description

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.

Recommendation

Update the mammoth package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.3.25, < 1.11.0
• Patched version(s): 1.11.0

References

• GHSA-rmjr-87wv-gf87
• security.snyk.io
• CVE-2025-11849
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Cross Site Scripting vulnerability in store2 - CVE-2024-57556
• Bootstrap Cross-site Scripting vulnerability - CVE-2016-10735
• protobufjs Prototype Pollution vulnerability - CVE-2023-36665
• chromedriver Command Injection vulnerability - CVE-2023-26156

Tags:

npm

mammoth