Executive brief
happy-dom is a JavaScript library that simulates a DOM environment for server-side rendering and testing. The vulnerability allows attackers to execute arbitrary code on the server by injecting a script tag, potentially leading to data theft, server compromise, or application takeover depending on the server's permissions and the data it can access.
Technical details
The vulnerability is a code execution flaw (CWE-79 / XSS-variant) in happy-dom's script tag handling. The root cause is insufficient sanitization or execution context isolation when processing <script> tags in parsed HTML content. An attacker can craft malicious HTML containing a script tag that, when parsed by happy-dom on the server, executes arbitrary JavaScript in the server's Node.js runtime. The attack requires the application to parse untrusted HTML input using happy-dom but does not require authentication or user interaction. The vulnerability has been patched in version 15.10.2.
Affected products
- happy-dom happy-dom before 15.10.2
Timeline
- 2024-11-06: disclosed
- 2024-11-06: patched: Version 15.10.2 released