# CVE-2026-33943: capricorn86 Happy DOM code injection in ECMAScriptModuleCompiler

Source: https://junglewise.ai/threats/cve-2026-33943-capricorn86-happy-dom-code-injection-in-ecmascriptmodulecompiler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-33943 · Severity: high · CVSS 8.8 · Published 2026-03-27

Happy DOM, a library used to simulate a web browser environment in JavaScript, contains a vulnerability that allows for remote code execution. An attacker can exploit this by providing specially crafted HTML or scripts that, when processed by the library, execute unauthorized commands on the underlying server or host system. This could lead to a full system compromise, data theft, or service disruption, particularly in applications that use Happy DOM to render user-provided content or scrape untrusted websites.

Technologies: [happy-dom (npm)](https://junglewise.ai/threats/technologies/happy-dom). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-33943 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33943 being exploited in the wild.

**How severe is CVE-2026-33943?** High severity, with a CVSS score of 8.8, published 27 March 2026.

**Which products and versions are affected?** happy-dom (npm) SEMVER:introduced=15.10.0,fixed=20.8.8.

**Is there a fix for CVE-2026-33943?** Yes. happy-dom (npm): upgrade to 20.8.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33943 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33943?** Check whether you run happy-dom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- happy-dom (npm): upgrade to 20.8.8 or later

  ```sh
  npm install happy-dom@20.8.8
  ```


## Technical details

A code injection vulnerability exists in the `ECMAScriptModuleCompiler` component of Happy DOM. The root cause is improper sanitization in the `export { }` declaration handler, where the compiler directly interpolates unsanitized content into generated code as an executable expression. While the library attempts to strip quotes, it fails to strip backticks, allowing template literal-based payloads to bypass sanitization and execute arbitrary JavaScript. This is exploitable when Happy DOM is configured to evaluate JavaScript and processes untrusted HTML or module scripts. The issue is fixed in version 20.8.8 by implementing stricter validation of identifiers and improved character filtering.

## Affected products

- capricorn86 happy-dom >= 15.10.0, < 20.8.8
- Red Hat Red Hat OpenShift Container Platform 4 4

## Identifiers

- CVE-2026-33943
- GHSA-6q6h-j7hj-3r64

## Timeline

- 2026-03-24: patched: Version 20.8.8 released to fix the issue.
- 2026-03-27: disclosed: Security advisory published by the maintainer.
- 2026-03-27: advisory: CVE-2026-33943 assigned and published.

## References

- [https://github.com/capricorn86/happy-dom/commit/5437fdf8f13adb9590f9f52616d9f69c3ee8db3c](https://github.com/capricorn86/happy-dom/commit/5437fdf8f13adb9590f9f52616d9f69c3ee8db3c)
- [https://github.com/capricorn86/happy-dom/releases/tag/v20.8.8](https://github.com/capricorn86/happy-dom/releases/tag/v20.8.8)
- [https://github.com/capricorn86/happy-dom/security/advisories/GHSA-6q6h-j7hj-3r64](https://github.com/capricorn86/happy-dom/security/advisories/GHSA-6q6h-j7hj-3r64)
- [https://access.redhat.com/security/cve/CVE-2026-33943](https://access.redhat.com/security/cve/CVE-2026-33943)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2452522](https://bugzilla.redhat.com/show_bug.cgi?id=2452522)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33943.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33943.json)

## Related threats

- [Happy DOM cookie scope forgery in CookieContainer](https://junglewise.ai/threats/cve-2026-118661-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [Happy DOM server-side request forgery via iframe and CSS loading](https://junglewise.ai/threats/cve-2026-118660-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [Happy DOM code injection in ESM compiler](https://junglewise.ai/threats/cve-2026-115895-happy-dom-is-a-javascript-implementation-of-a-web-browser)
- [capricorn86 Happy DOM cookie leakage in fetch requests](https://junglewise.ai/threats/cve-2026-34226-capricorn86-happy-dom-cookie-leakage-in-fetch-requests)
- [happy-dom prototype pollution allowing arbitrary code execution](https://junglewise.ai/threats/cve-2025-62410-happy-dom-prototype-pollution-allowing-arbitrary-code-execution)