Vendor
A code injection vulnerability exists in Happy DOM's ECMAScriptModuleCompiler, allowing remote code execution (RCE) by injecting arbitrary JavaScript expressions into `export { }` declarations, enabling command execution if JavaScript evaluation is enabled.