{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/happy-dom/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:capricorn86:happy_dom:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"id":"CVE-2024-51757"},{"id":"CVE-2025-61927"},{"cvss":8.8,"id":"CVE-2026-33943"},{"cvss":8.8,"id":"CVE-2026-115895"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["happy-dom","rce","code-injection","javascript"],"_cs_type":"advisory","_cs_vendors":["Happy DOM"],"content_html":"\u003cp\u003eHappy DOM, a browser automation library, is susceptible to a code injection vulnerability within its \u003ccode\u003eECMAScriptModuleCompiler\u003c/code\u003e. This flaw allows attackers to inject arbitrary JavaScript expressions into \u003ccode\u003eexport { }\u003c/code\u003e declarations in ES module scripts. Specifically, the compiler directly interpolates unsanitized content into generated code as an executable expression. The inadequate sanitization, which fails to strip backticks, enables the use of template literals to bypass security measures. This vulnerability is present in versions 15.10.0 through 20.8.7 and can be exploited when JavaScript evaluation is explicitly enabled. This issue differs from CVE-2024-51757 and CVE-2025-61927, which were patched in earlier versions. Defenders should be aware of the risk, particularly in environments where happy-dom processes untrusted HTML content.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker injects malicious JavaScript code within an HTML \u003ccode\u003e\u0026lt;script type=\u0026quot;module\u0026quot;\u0026gt;\u003c/code\u003e tag intended for processing by happy-dom. The payload is crafted within an \u003ccode\u003eexport { ... }\u003c/code\u003e declaration. For example: \u003ccode\u003eexport { require(\u003c/code\u003echild_process\u003ccode\u003e).execSync(\u003c/code\u003eid\u003ccode\u003e) }\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eHappy DOM's \u003ccode\u003eECMAScriptModuleCompiler.ts\u003c/code\u003e processes the HTML, extracting the content within the \u003ccode\u003eexport { ... }\u003c/code\u003e declaration using a regular expression that is overly permissive.\u003c/li\u003e\n\u003cli\u003eThe extracted content, \u003ccode\u003erequire(\\\u003c/code\u003echild_process`).execSync(`id`)`, is passed through a flawed sanitization function that removes single and double quotes but fails to remove backticks.\u003c/li\u003e\n\u003cli\u003eThe unsanitized content is then directly interpolated into the generated JavaScript code as an executable expression: \u003ccode\u003e$happy_dom.exports['${exportName}'] = ${importName}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe generated JavaScript code, now containing the injected malicious command, is evaluated by happy-dom's scripting engine.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003echild_process.execSync\u003c/code\u003e function executes the injected command (\u003ccode\u003eid\u003c/code\u003e in this example) on the host system.\u003c/li\u003e\n\u003cli\u003eThe output of the command is captured and potentially used for further exploitation or data exfiltration.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves Remote Code Execution (RCE) on the host system, gaining the ability to execute arbitrary commands.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to achieve remote code execution (RCE) on systems using happy-dom to process HTML with JavaScript evaluation enabled. This can lead to complete system compromise, data theft, or denial of service. The vulnerability affects applications using happy-dom for server-side rendering (SSR) of user-supplied HTML, web scraping of untrusted content, and testing pipelines that load untrusted HTML fixtures. Given the wide use of JavaScript-based tools and frameworks, the impact can be significant for vulnerable systems where JavaScript evaluation is enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a patched version of happy-dom that addresses CVE-2026-33943 once available.\u003c/li\u003e\n\u003cli\u003eDisable JavaScript evaluation in happy-dom if it is not required for your application to mitigate CVE-2026-33943.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sanitization of any HTML content processed by happy-dom, ensuring that \u003ccode\u003eexport { ... }\u003c/code\u003e declarations do not contain potentially malicious JavaScript code.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Happy DOM RCE via export injection\u003c/code\u003e to detect exploitation attempts based on process creation with the \u003ccode\u003echild_process\u003c/code\u003e module.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious requests containing JavaScript code within \u003ccode\u003e\u0026lt;script type=\u0026quot;module\u0026quot;\u0026gt;\u003c/code\u003e tags that could be used to inject malicious payloads (see \u003ccode\u003eDetect Happy DOM RCE via web request\u003c/code\u003e Sigma rule).\u003c/li\u003e\n\u003cli\u003eEnable Sysmon process creation logging to enhance visibility into spawned processes and detect potential command execution resulting from this vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T03:46:00Z","date_published":"2024-07-03T14:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-07-happy-dom-rce/","summary":"A code injection vulnerability exists in Happy DOM's ECMAScriptModuleCompiler, allowing remote code execution (RCE) by injecting arbitrary JavaScript expressions into `export { }` declarations, enabling command execution if JavaScript evaluation is enabled.","title":"Happy DOM ECMAScriptModuleCompiler Remote Code Execution","url":"https://feed.craftedsignal.io/briefs/2024-07-happy-dom-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Happy DOM","version":"https://jsonfeed.org/version/1.1"}