Remote Code Execution Vulnerability in Happy DOM by Capricorn86

CVE-2025-61927

What is CVE-2025-61927?

Happy DOM, a JavaScript implementation without a graphical user interface, is impacted by a vulnerability that exposes systems to Remote Code Execution (RCE) risks. In versions up to 19, the Node.js VM Context does not provide sufficient isolation, allowing untrusted JavaScript code execution to potentially escape the VM, depending on whether the process uses ESM or CommonJS. Attackers may exploit this flaw to access process-level functionalities and utilize the 'require()' function in CommonJS setups to import malicious modules. With JavaScript evaluation enabled by default, users may unwittingly execute unsafe code unless they upgrade to version 20.0.0, which disables this feature by default.

References