Happy DOM ECMAScriptModuleCompiler Remote Code Execution

Happy DOM, a browser automation library, is susceptible to a code injection vulnerability within its ECMAScriptModuleCompiler. This flaw allows attackers to inject arbitrary JavaScript expressions into export { } declarations in ES module scripts. Specifically, the compiler directly interpolates unsanitized content into generated code as an executable expression. The inadequate sanitization, which fails to strip backticks, enables the use of template literals to bypass security measures. This vulnerability is present in versions 15.10.0 through 20.8.7 and can be exploited when JavaScript evaluation is explicitly enabled. This issue differs from CVE-2024-51757 and CVE-2025-61927, which were patched in earlier versions. Defenders should be aware of the risk, particularly in environments where happy-dom processes untrusted HTML content.

Attack Chain

1. The attacker injects malicious JavaScript code within an HTML <script type="module"> tag intended for processing by happy-dom. The payload is crafted within an export { ... } declaration. For example: export { require(child_process).execSync(id) }.
2. Happy DOM's ECMAScriptModuleCompiler.ts processes the HTML, extracting the content within the export { ... } declaration using a regular expression that is overly permissive.
3. The extracted content, require(\child_process`).execSync(`id`)`, is passed through a flawed sanitization function that removes single and double quotes but fails to remove backticks.
4. The unsanitized content is then directly interpolated into the generated JavaScript code as an executable expression: $happy_dom.exports['${exportName}'] = ${importName}.
5. The generated JavaScript code, now containing the injected malicious command, is evaluated by happy-dom's scripting engine.
6. The child_process.execSync function executes the injected command (id in this example) on the host system.
7. The output of the command is captured and potentially used for further exploitation or data exfiltration.
8. The attacker achieves Remote Code Execution (RCE) on the host system, gaining the ability to execute arbitrary commands.

Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution (RCE) on systems using happy-dom to process HTML with JavaScript evaluation enabled. This can lead to complete system compromise, data theft, or denial of service. The vulnerability affects applications using happy-dom for server-side rendering (SSR) of user-supplied HTML, web scraping of untrusted content, and testing pipelines that load untrusted HTML fixtures. Given the wide use of JavaScript-based tools and frameworks, the impact can be significant for vulnerable systems where JavaScript evaluation is enabled.

Recommendation

• Upgrade to a patched version of happy-dom that addresses CVE-2026-33943 once available.
• Disable JavaScript evaluation in happy-dom if it is not required for your application to mitigate CVE-2026-33943.
• Implement strict input validation and sanitization of any HTML content processed by happy-dom, ensuring that export { ... } declarations do not contain potentially malicious JavaScript code.
• Deploy the Sigma rule Detect Happy DOM RCE via export injection to detect exploitation attempts based on process creation with the child_process module.
• Monitor web server logs for suspicious requests containing JavaScript code within <script type="module"> tags that could be used to inject malicious payloads (see Detect Happy DOM RCE via web request Sigma rule).
• Enable Sysmon process creation logging to enhance visibility into spawned processes and detect potential command execution resulting from this vulnerability.