Description
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mwilliamson | mammoth.js | 1.3.0 – < 1.12.3 | 1.12.3 |
References
- GitHub Issue #487 issue-tracking
- https://github.com/mwilliamson/mammoth.js/commit/dc49225425c2c07de0a6dc3529f2386c82a032b4 patch
- https://github.com/mwilliamson/mammoth.js/blob/1.12.2/lib/styles/parser/tokeniser.js#L6-L30 technical-description
- https://github.com/mwilliamson/mammoth.js product
- VulnCheck Advisory: Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser third-party-advisory