CVE-2026-33943
Code Injection in Happy DOM ECMAScriptModuleCompiler Enables RCE
Publication date: 2026-03-27
Last updated on: 2026-04-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| capricorn86 | happy_dom | From 15.10.0 (inc) to 20.8.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Happy DOM, a JavaScript implementation of a web browser without a graphical user interface. In versions 15.10.0 through 20.8.7, there is a code injection flaw in the ECMAScriptModuleCompiler component. An attacker can inject arbitrary JavaScript expressions inside export { } declarations in ES module scripts processed by Happy DOM. The compiler directly inserts unsanitized content into generated code as executable expressions. Additionally, the quote filter used does not remove backticks, which allows attackers to bypass sanitization using template literal-based payloads. This flaw enables Remote Code Execution (RCE). The issue is fixed in version 20.8.8.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows an attacker to execute arbitrary code remotely on systems using vulnerable versions of Happy DOM. This can lead to full system compromise, unauthorized access to sensitive data, disruption of services, and potential further exploitation within the affected environment.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Happy DOM to version 20.8.8 or later, where the issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Happy DOM allows remote code execution through code injection, which can lead to unauthorized access, data manipulation, or data breaches.
Such security weaknesses can impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and maintaining system integrity.
However, specific effects on compliance depend on the context of use and whether the vulnerable component processes or protects regulated data.