CVE-2025-61927
BaseFortify
Publication date: 2025-10-10
Last updated on: 2025-10-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| capricorn86 | happy-dom | 20.0.0 |
| capricorn86 | happy-dom | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
Happy DOM v19 and lower has a security vulnerability where the Node.js VM Context used is not truly isolated. If untrusted JavaScript code is run within this VM Context, it can escape the sandbox and gain access to process-level functionality, potentially allowing remote code execution (RCE). The level of control an attacker gains depends on whether the process uses ESM or CommonJS modules. In CommonJS, the attacker can access the require() function to import modules. This vulnerability exists because JavaScript evaluation is enabled by default, which may not be obvious to users. Version 20.0.0 fixes this by disabling JavaScript evaluation by default.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute arbitrary code on the system running Happy DOM if untrusted JavaScript is executed within its VM Context. This can lead to full system compromise, data theft, or other malicious activities depending on the attacker's goals and the environment's configuration.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Happy DOM to version 20.0.0 or later, as this version disables JavaScript evaluation by default, mitigating the risk of Remote Code Execution when running untrusted JavaScript code within the Happy DOM VM Context.