Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
Happy DOMの17.0.0から21.0.3までの版では、ESMのimport別名の検証が不十分なため、細工されたHTMLやモジュールによってNode.jsのホストプロセス上でJavaScriptコードが実行される可能性があります。JavaScript評価(enableJavaScriptEvaluation)を有効にしている場合に影響を受けます。修正版の21.0.4へ更新してください。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| capricorn86 | happy-dom | — | — |
| npm | happy-dom |
≥ 17.0.0, < 21.0.4 |
21.0.4 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Summary
The ESM compiler in happy-dom@20.14.5 does not validate imported local binding aliases before interpolating them into generated JavaScript.
As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed.
This appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates importName in the local export { ... } handler, but the named import handler still places an unvalidated alias directly into code context.
These issues were confirmed through the public Window and `` APIs using the published happy-dom npm package. The PoC reaches the Node.js host process, obtains node:fs, and creates a proof directory on the host filesystem.
Confirmed affected versions
The PoC was directly tested against:
happy-dom@17.0.0happy-dom@20.0.0happy-dom@20.1.0happy-dom@20.14.5
The same PoC does not trigger on happy-dom@16.8.1.
The ESM compiler was introduced by commit 7bc831df2, first released in v17.0.0. The vulnerable interpolation remains present through v20.14.5, the latest release at the time of testing.
Suggested affected range:
>= 17.0.0, <= 20.14.5
No patched version is currently available.
Preconditions
- JavaScript evaluation is enabled with
enableJavaScriptEvaluation: true. - Attacker-controlled HTML or module source is processed by Happy DOM.
- This may affect S…
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory