https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T15:27:34.579609+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-337327 EUVD-2026-337327 2026-10-15T15:27:34.637419+00:00 EUVD-2026-337327 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33943 fkie_cve-2026-33943 2026-10-15T15:27:34.637461+00:00

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-6q6h-j7hj-3r64 GHSA-6q6h-j7hj-3r64 — Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code 2026-10-15T15:27:34.637507+00:00

Affected: npm: happy-dom

### Summary

A code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization.

### Details

**Vulnerable file**: `packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts`, lines 371-385

The "Export object" handler extracts content from `export { ... }` using the regex `export\s*{([^}]+)}`, then generates executable code by directly interpolating it:

} else if (match[16] && isTopLevel && PRECEDING_STATEMENT_TOKEN_REGEXP.test(precedingToken)) { // Export object const parts = this.removeMultilineComments(match[16]).split(/\s*,\s*/); const exportCode: string[] = []; for (const part of parts) { const nameParts = part.trim().split(/\s+as\s+/); const exportName = (nameParts[1] || nameParts[0]).replace(/["']/g, ''); const importName = nameParts[0].replace(/["']/g, ''); // backticks NOT stripped if (exportName && importName) { exportCode.push(`$happy_dom.exports['${exportName}'] = ${importName}`); // importName is inserted as executable code, not as a string…