# CVE-2025-61927: Happy DOM VM Context Escape leading to Remote Code Execution

Source: https://junglewise.ai/threats/cve-2025-61927-happy-dom-vm-context-escape-leading-to-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-61927 · Severity: medium · CVSS 4 · Published 2025-10-10

Happy DOM is a JavaScript library that simulates a DOM environment for server-side rendering and testing. Versions 19 and below allow attackers to escape the VM sandbox by exploiting how JavaScript functions inherit from a global Function constructor, potentially gaining access to process-level functionality like file system and module loading. An attacker who can execute untrusted JavaScript code within Happy DOM can read environment variables, access configuration files, execute arbitrary commands, and modify the host system.

Technologies: [happy-dom (npm)](https://junglewise.ai/threats/technologies/happy-dom). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-61927 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61927 being exploited in the wild.

**How severe is CVE-2025-61927?** Medium severity, with a CVSS score of 4, published 10 October 2025.

**Which products and versions are affected?** happy-dom (npm) SEMVER:introduced=0,fixed=20.0.0.

**Is there a fix for CVE-2025-61927?** Yes. happy-dom (npm): upgrade to 20.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-61927 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-61927?** Check whether you run happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- happy-dom (npm): upgrade to 20.0.0 or later

  ```sh
  npm install happy-dom@20.0.0
  ```


## Technical details

The vulnerability is a code injection issue (CWE-94) caused by improper VM isolation in Node.js. Happy DOM wraps JavaScript execution in a VM Context; however, the JavaScript standard's prototype chain allows objects to reference the global Function constructor via constructor.constructor. An attacker can invoke this Function constructor with arbitrary code strings to execute code at the process level (outside the VM). JavaScript evaluation is enabled by default in versions 19 and below. With CommonJS, this grants access to the require() function to load arbitrary modules; with ESM, attackers gain direct process object access. The attack requires only the ability to inject or control HTML/JavaScript content passed to Happy DOM. Patched in version 20.0.0, which disables JavaScript evaluation by default and warns if it is enabled without the Node.js flag --disallow-code-generation-from-strings.

## Affected products

- Capricorn86 Happy DOM 0 to 19

## Identifiers

- CVE-2025-61927
- GHSA-37j7-fg3j-429f

## Timeline

- 2025-10-10: disclosed: Advisory published
- 2025-10-10: patched: Happy DOM v20.0.0 released with JavaScript evaluation disabled by default

## References

- [https://github.com/capricorn86/happy-dom/security/advisories/GHSA-37j7-fg3j-429f](https://github.com/capricorn86/happy-dom/security/advisories/GHSA-37j7-fg3j-429f)
- [https://github.com/capricorn86/happy-dom/commit/819d15ba289495439eda8be360d92a614ce22405](https://github.com/capricorn86/happy-dom/commit/819d15ba289495439eda8be360d92a614ce22405)
- [https://github.com/capricorn86/happy-dom/commit/de438ad72921c69793584aa657b48d3655dfac97](https://github.com/capricorn86/happy-dom/commit/de438ad72921c69793584aa657b48d3655dfac97)
- [https://github.com/capricorn86/happy-dom](https://github.com/capricorn86/happy-dom)
- [https://github.com/capricorn86/happy-dom/releases/tag/v20.0.0](https://github.com/capricorn86/happy-dom/releases/tag/v20.0.0)

## Related threats

- [Happy DOM cookie scope forgery in CookieContainer](https://junglewise.ai/threats/cve-2026-118661-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [Happy DOM server-side request forgery via iframe and CSS loading](https://junglewise.ai/threats/cve-2026-118660-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [Happy DOM code injection in ESM compiler](https://junglewise.ai/threats/cve-2026-115895-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [capricorn86 Happy DOM cookie leakage in fetch requests](https://junglewise.ai/threats/cve-2026-34226-capricorn86-happy-dom-cookie-leakage-in-fetch-requests)
- [capricorn86 Happy DOM code injection in ECMAScriptModuleCompiler](https://junglewise.ai/threats/cve-2026-33943-capricorn86-happy-dom-code-injection-in-ecmascriptmodulecompiler)