Code Injection Vulnerability in Happy DOM JavaScript Implementation
CVE-2026-33943
8.8HIGH
What is CVE-2026-33943?
Happy DOM, a lightweight JavaScript implementation of a web browser without a graphical user interface, contains a code injection vulnerability affecting versions 15.10.0 through 20.8.7. This vulnerability is found in the 'ECMAScriptModuleCompiler' component, where an attacker can exploit this flaw to perform Remote Code Execution (RCE). The risk arises from the compiler's unsanitized handling of JavaScript code injected into 'export { }' declarations in ES module scripts. The lack of proper sanitization allows template literal-based payloads to bypass security measures, compromising code integrity. The issue is resolved in version 20.8.8, which implements necessary security enhancements.
Affected Version(s)
happy-dom >= 15.10.0, < 20.8.8