Most recent entries from all

EUVD-2026-254687

fkie_cve-2025-61927

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks. A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality. It seems like what the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the `require()` function to import modules. Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment. Version 20.0.0 patches the issue by changing JavaScript evaluation to be disabled by default.

GHSA-37j7-fg3j-429f — Happy DOM: VM Context Escape can lead to Remote Code Execution

Affected: npm: happy-dom

# Escape of VM Context gives access to process level functionality

## Summary Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks.

A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality.

It seems like what the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the `require()` function to import modules.

Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment.

## Reproduce

### CommonJS (Possible to get hold of require)

```javascript const { Window } = require('happy-dom'); const window = new Window({ console });

window.document.write(` <script> const process = this.constructor.constructor('return process')(); const require = process.mainModule.require; console.log('Files:', require('fs').readdirSync('.').slice(0,3)); </script> `); ``` ### ESM (Not possible to get hold of import or require)

```javascript const { Window } = require('happy-dom'); const window = new Window({ console });

window.document.write(` <script> const process = this.constructor.constructor('return process')(); console.…

RHSA-2025:23225 — Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.25.0 Release.

micromatch: vulnerable to Regular Expression Denial of Service dotnet: .NET Denial of Service Vulnerability dotnet: .NET Information Disclosure Vulnerability dotnet: .NET Security Feature Bypass Vulnerability tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE happy-dom: Happy-DOM VM Context Escape tika-core: tika-parsers: tika-parser-pdf-module: Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected