Quick answers
- Is CVE-2024-51757 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-51757 being exploited in the wild.
- How severe is CVE-2024-51757?
- Medium severity, with a CVSS score of 4, published 6 November 2024.
- Which products and versions are affected?
- happy-dom (npm) SEMVER:introduced=0,fixed=15.10.2.
- Is there a fix for CVE-2024-51757?
- Yes. happy-dom (npm): upgrade to 15.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-51757 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-51757?
- Check whether you run happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- happy-dom (npm): upgrade to 15.10.2 or later
npm install happy-dom@15.10.2
Technical details
The vulnerability is a code execution flaw (CWE-79 / XSS-variant) in happy-dom's script tag handling. The root cause is insufficient sanitization or execution context isolation when processing <script> tags in parsed HTML content. An attacker can craft malicious HTML containing a script tag that, when parsed by happy-dom on the server, executes arbitrary JavaScript in the server's Node.js runtime. The attack requires the application to parse untrusted HTML input using happy-dom but does not require authentication or user interaction. The vulnerability has been patched in version 15.10.2.
Affected products
- happy-dom happy-dom before 15.10.2
Identifiers
- CVE-2024-51757
- GHSA-96g7-g7g9-jxw8
Timeline
- 2024-11-06: disclosed
- 2024-11-06: patched: Version 15.10.2 released