Is CVE-2025-62410 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-62410 being exploited in the wild.

How severe is CVE-2025-62410?

Medium severity, with a CVSS score of 4, published 15 October 2025.

Which products and versions are affected?

happy-dom (npm) SEMVER:introduced=19.0.0,fixed=20.0.2.

Is there a fix for CVE-2025-62410?

Yes. happy-dom (npm): upgrade to 20.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-62410 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-62410?

Check whether you run happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-62410: happy-dom prototype pollution allowing arbitrary code execution

CVE-2025-62410 · Severity: medium · CVSS 4 · Published 2025-10-15

happy-dom is a Node.js library that simulates a web browser environment for running untrusted JavaScript code. Even when configured with code-generation safeguards, attackers can exploit prototype pollution vulnerabilities to break out of the sandbox and execute arbitrary system commands, potentially compromising any service that uses this library to run untrusted scripts.

Technologies: happy-dom (npm). Vendors: npm.

Quick answers

Is CVE-2025-62410 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-62410 being exploited in the wild.
How severe is CVE-2025-62410?: Medium severity, with a CVSS score of 4, published 15 October 2025.
Which products and versions are affected?: happy-dom (npm) SEMVER:introduced=19.0.0,fixed=20.0.2.
Is there a fix for CVE-2025-62410?: Yes. happy-dom (npm): upgrade to 20.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-62410 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-62410?: Check whether you run happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

happy-dom (npm): upgrade to 20.0.2 or later
```
npm install happy-dom@20.0.2
```

Technical details

The vulnerability is a sandbox escape caused by insufficient isolation when executing untrusted JavaScript. While happy-dom's `--disallow-code-generation-from-strings` flag blocks eval() and Function() calls, untrusted code still runs in the same Node.js Isolate/process as the host application. Attackers can leverage prototype pollution on built-in objects (e.g., polluting Object.prototype.hasOwnProperty) to gain access to the global `process` object and invoke child_process operations like spawnSync(). The root cause is that the VM isolation does not prevent access to shared global scope and prototype chain manipulation. Attack requires JavaScript evaluation to be enabled and user-supplied or attacker-controlled HTML/JavaScript content to be processed by the library. The fix was released in version 20.0.2; users are advised to migrate to isolated-vm for stronger sandbox isolation.

Affected products

happy-dom happy-dom < 20.0.2

Identifiers

CVE-2025-62410
GHSA-qpm2-6cq5-7pq5

Timeline

2025-10-15: disclosed
2025-10-15: patched: Fixed in version 20.0.2

References

https://github.com/capricorn86/happy-dom/security/advisories/GHSA-qpm2-6cq5-7pq5

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.