An issue in Happy DOM's ECMAScriptModuleCompiler allows the interpreter to insert unsanitized export names directly into generated code. Through this mechanism, an attacker can inject arbitrary JavaScript expressions inside export { } declarations in ES module scripts, bypassing the built‑in quote filter because backticks are not removed. The result is remote code execution within the environment that consumes Happy DOM. The vulnerability is classified as Code Injection (CWE‑94) and the execution of unsanitized content (CWE‑917).

The flaw exists in versions 15.10.0 through 20.8.7 of the Happy DOM library distributed by Capricorn86. Applications that rely on these versions to parse or execute ES modules will be impacted; the fix is available in version 20.8.8 and later.

The CVSS score of 8.8 indicates a high severity level, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires that an attacker can supply or influence the ES module source that Happy DOM compiles, which is typically a local developer or a compromised application. If such code can be injected, the attacker can execute arbitrary JavaScript with the privileges of the host process.