Executive brief
happy-dom is a Node.js library that simulates a web browser environment for running untrusted JavaScript code. Even when configured with code-generation safeguards, attackers can exploit prototype pollution vulnerabilities to break out of the sandbox and execute arbitrary system commands, potentially compromising any service that uses this library to run untrusted scripts.
Technical details
The vulnerability is a sandbox escape caused by insufficient isolation when executing untrusted JavaScript. While happy-dom's `--disallow-code-generation-from-strings` flag blocks eval() and Function() calls, untrusted code still runs in the same Node.js Isolate/process as the host application. Attackers can leverage prototype pollution on built-in objects (e.g., polluting Object.prototype.hasOwnProperty) to gain access to the global `process` object and invoke child_process operations like spawnSync(). The root cause is that the VM isolation does not prevent access to shared global scope and prototype chain manipulation. Attack requires JavaScript evaluation to be enabled and user-supplied or attacker-controlled HTML/JavaScript content to be processed by the library. The fix was released in version 20.0.2; users are advised to migrate to isolated-vm for stronger sandbox isolation.
Affected products
- happy-dom happy-dom < 20.0.2
Timeline
- 2025-10-15: disclosed
- 2025-10-15: patched: Fixed in version 20.0.2