Junglewise Threat Intelligence

CVE-2026-33943: capricorn86 Happy DOM code injection in ECMAScriptModuleCompiler

CVE-2026-33943 · Severity: high · CVSS 8.8 · Published 2026-03-27

Technologies: Capricorn86 Happy-Dom. Vendors: Red Hat, npm.

Executive brief

Happy DOM, a library used to simulate a web browser environment in JavaScript, contains a vulnerability that allows for remote code execution. An attacker can exploit this by providing specially crafted HTML or scripts that, when processed by the library, execute unauthorized commands on the underlying server or host system. This could lead to a full system compromise, data theft, or service disruption, particularly in applications that use Happy DOM to render user-provided content or scrape untrusted websites.

Technical details

A code injection vulnerability exists in the `ECMAScriptModuleCompiler` component of Happy DOM. The root cause is improper sanitization in the `export { }` declaration handler, where the compiler directly interpolates unsanitized content into generated code as an executable expression. While the library attempts to strip quotes, it fails to strip backticks, allowing template literal-based payloads to bypass sanitization and execute arbitrary JavaScript. This is exploitable when Happy DOM is configured to evaluate JavaScript and processes untrusted HTML or module scripts. The issue is fixed in version 20.8.8 by implementing stricter validation of identifiers and improved character filtering.

Affected products

  • capricorn86 happy-dom >= 15.10.0, < 20.8.8
  • Red Hat Red Hat OpenShift Container Platform 4 4

Timeline

  • 2026-03-24: patched: Version 20.8.8 released to fix the issue.
  • 2026-03-27: disclosed: Security advisory published by the maintainer.
  • 2026-03-27: advisory: CVE-2026-33943 assigned and published.

References

Related threats