https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-30T11:24:16.195106+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-118660 CVE-2026-118660 — Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML 2026-10-30T11:24:16.195981+00:00

Affected: capricorn86 happy-dom

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.