A malformed ES module import alias in Happy DOM’s compiler can be exploited when JavaScript evaluation is enabled, allowing an attacker to inject arbitrary code that executes in the Node.js host process. The flaw caused the alias to become a valid default initializer after compilation, leading to remote code execution through user‑controlled HTML or module source. This is a distinct residual path from a prior remediation that only validated local export names and did not address named‑import aliases.

The vulnerability exists in Happy DOM by capricorn86 versions 17.0.0 through 21.0.3, inclusive. Versions 21.0.4 and newer contain the fix.

The CVSS score of 8.8 indicates high severity. With no EPSS data, the exploit probability is uncertain, and the issue is not listed in the CISA KEV catalog. The likely attack vector requires an application that runs Happy DOM with enableJavaScriptEvaluation on and processes attacker‑controlled module source, making the vulnerability exploitable in environments that import untrusted modules.