Junglewise Threat Intelligence

CVE-2024-51757: happy-dom server-side code execution via script tag

CVE-2024-51757 · Severity: medium · CVSS 4 · Published 2024-11-06

Technologies: Happy-Dom. Vendors: npm.

Executive brief

happy-dom is a JavaScript library that simulates a DOM environment for server-side rendering and testing. The vulnerability allows attackers to execute arbitrary code on the server by injecting a script tag, potentially leading to data theft, server compromise, or application takeover depending on the server's permissions and the data it can access.

Technical details

The vulnerability is a code execution flaw (CWE-79 / XSS-variant) in happy-dom's script tag handling. The root cause is insufficient sanitization or execution context isolation when processing <script> tags in parsed HTML content. An attacker can craft malicious HTML containing a script tag that, when parsed by happy-dom on the server, executes arbitrary JavaScript in the server's Node.js runtime. The attack requires the application to parse untrusted HTML input using happy-dom but does not require authentication or user interaction. The vulnerability has been patched in version 15.10.2.

Affected products

  • happy-dom happy-dom before 15.10.2

Timeline

  • 2024-11-06: disclosed
  • 2024-11-06: patched: Version 15.10.2 released

References

Related threats