CVE-2026-33943highCWE-917CWE-94

CVE-2026-33943: falha de alta gravidade em capricorn86 happy-dom

Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar happy-dom+ Monitorar happy-dom

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.6%
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
capricorn86 · happy-dom
CVEs relacionadas — capricorn86 happy-dom

No mesmo produto, das mais perigosas para as menos.

CVE-2024-51757CRITICALFixes security vulnerability that allowed for server side code to be executed by a <script> tagEPSS 0.8%CVE-2025-61927HIGHHappy-DOM has VM Context EscapeEPSS 0.6%CVE-2026-115895HIGHHappy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code executionEPSS 0.5%CVE-2026-34226HIGHHappy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookiesEPSS 0.5%CVE-2026-118660HIGHHappy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLEPSS 0.4%CVE-2026-118659HIGH@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open ProxyEPSS 0.4%