{"id":"EUVD-2026-16864","enisaUuid":"c555c326-9121-3c00-9d56-7381d723f034","description":"Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.","datePublished":"Mar 27, 2026, 9:15:19 PM","dateUpdated":"Jul 15, 2026, 1:05:08 AM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/capricorn86/happy-dom/security/advisories/GHSA-6q6h-j7hj-3r64\nhttps://github.com/capricorn86/happy-dom/commit/5437fdf8f13adb9590f9f52616d9f69c3ee8db3c\nhttps://github.com/capricorn86/happy-dom/releases/tag/v20.8.8\n","aliases":"CVE-2026-33943\nGHSA-6q6h-j7hj-3r64\n","assigner":"GitHub_M","epss":0.65,"enisaIdProduct":[{"id":"e5d13415-9a53-3695-a943-1f1060cce102","product":{"name":"happy-dom","vendor":{"name":"capricorn86"}},"product_version":"15.10.0, \u003c 20.8.8"}],"enisaIdVendor":[{"id":"9264ed2d-f213-3fbf-9b09-e3e450d42c1e","vendor":{"name":"capricorn86"}}],"enisaIdVulnerability":[{"id":"0381a0fd-846d-34d1-9b02-4d5d0c4b3142","vulnerability":{"id":"GHSA-6q6h-j7hj-3r64","description":"Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code","datePublished":"Mar 26, 2026, 10:22:20 PM","dateUpdated":"Mar 30, 2026, 8:07:48 PM","baseScore":0.0,"references":"https://github.com/capricorn86/happy-dom/security/advisories/GHSA-6q6h-j7hj-3r64\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33943\nhttps://github.com/capricorn86/happy-dom/commit/5437fdf8f13adb9590f9f52616d9f69c3ee8db3c\nhttps://github.com/capricorn86/happy-dom\nhttps://github.com/capricorn86/happy-dom/releases/tag/v20.8.8\n","enisa_id":"EUVD-2026-16864\n","aliases":"CVE-2026-33943\nGHSA-6q6h-j7hj-3r64\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:58:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fb884295-5be2-3432-9e64-e95a68621fab","vulnerability":{"id":"CVE-2026-33943","description":"Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.","datePublished":"Mar 27, 2026, 9:15:19 PM","dateUpdated":"Jul 15, 2026, 1:05:08 AM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/capricorn86/happy-dom/security/advisories/GHSA-6q6h-j7hj-3r64\nhttps://github.com/capricorn86/happy-dom/commit/5437fdf8f13adb9590f9f52616d9f69c3ee8db3c\nhttps://github.com/capricorn86/happy-dom/releases/tag/v20.8.8\n","enisa_id":"EUVD-2026-16864\n","assigner":"GitHub_M","epss":0.65,"dataProcessed":"Nov 7, 2026, 7:22:05 AM","vulnerabilityProduct":[{"id":"1a899f3c-0bfd-3db8-986f-7d6fe27b0dd6","product":{"name":"happy-dom","vendor":{"name":"capricorn86"}},"product_version":"15.10.0, \u003c 20.8.8"}],"vulnerabilityVendor":[{"id":"b5473957-03e0-3290-9404-92e256e63e8b","vendor":{"name":"capricorn86"}}]}}],"enisaIdAdvisory":[]}