CVE-2026-115895

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

View on CVE.org
Published Oct 23, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it into a generated destructuring binding. With enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can use an invalid alias that becomes a valid default initializer after compilation, causing the generated JavaScript to execute in the Node.js host process. The demonstrated reachable path uses a JSON module import attribute, which prevents the malicious alias from being emitted again in a later ESM circular-import assignment and keeps the generated function syntactically valid. This incomplete fix for CVE-2026-33943 is a distinct residual path because the earlier remediation validated the local export importName path but not the named-import alias. This issue is fixed in version 21.0.4.

Analysis

AI-generated

Technical impact

A malformed ES module import alias in Happy DOM’s compiler can be exploited when JavaScript evaluation is enabled, allowing an attacker to inject arbitrary code that executes in the Node.js host process. The flaw caused the alias to become a valid default initializer after compilation, leading to remote code execution through user‑controlled HTML or module source. This is a distinct residual path from a prior remediation that only validated local export names and did not address named‑import aliases.

Affected Systems

The vulnerability exists in Happy DOM by capricorn86 versions 17.0.0 through 21.0.3, inclusive. Versions 21.0.4 and newer contain the fix.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. With no EPSS data, the exploit probability is uncertain, and the issue is not listed in the CISA KEV catalog. The likely attack vector requires an application that runs Happy DOM with enableJavaScriptEvaluation on and processes attacker‑controlled module source, making the vulnerability exploitable in environments that import untrusted modules.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Happy DOM to v21.0.4 or later
  • If an upgrade is not possible, disable the enableJavaScriptEvaluation option so module imports are not evaluated
  • If you must keep enableJavaScriptEvaluation, ensure that only trusted module source code is processed or validate module import aliases before execution.

Generated by OpenCVE AI on October 23, 2026 at 22:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-834v-8h66-3h79 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
First Time appeared Capricorn86
Capricorn86 happy-dom
Vendors & Products Capricorn86
Capricorn86 happy-dom
Type Values Removed Values Added
Description Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it into a generated destructuring binding. With enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can use an invalid alias that becomes a valid default initializer after compilation, causing the generated JavaScript to execute in the Node.js host process. The demonstrated reachable path uses a JSON module import attribute, which prevents the malicious alias from being emitted again in a later ESM circular-import assignment and keeps the generated function syntactically valid. This incomplete fix for CVE-2026-33943 is a distinct residual path because the earlier remediation validated the local export importName path but not the named-import alias. This issue is fixed in version 21.0.4.
Title Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Oct 30, 2026, 6:43 PM
Reserved
Oct 23, 2026, 7:37 PM

View source JSON

Updated
Oct 30, 2026, 6:43 PM

JSON

Status
Awaiting Analysis
Published
Oct 23, 2026, 10:16 PM
Modified
Oct 30, 2026, 7:18 PM

View source JSON

Severity
Important
Public date
Oct 23, 2026, 9:32 PM

View source Bugzilla JSON

Updated
Oct 23, 2026, 11:30 PM

JSON