CVE-2026-33943
Description
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside export { } declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
happy-domnpm | >= 15.10.0, < 20.8.8 | 20.8.8 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/capricorn86/happy-dom/commit/5437fdf8f13adb9590f9f52616d9f69c3ee8db3cnvdPatchWEB
- github.com/capricorn86/happy-dom/security/advisories/GHSA-6q6h-j7hj-3r64nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-6q6h-j7hj-3r64ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33943ghsaADVISORY
- github.com/capricorn86/happy-dom/releases/tag/v20.8.8nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.