https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 07:25:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337327 EUVD-2026-337327 https://cve.radiocsirt.org/vuln/euvd-2026-337327 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33943 <p>Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.</p> <p>Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33943 https://cve.radiocsirt.org/vuln/ghsa-6q6h-j7hj-3r64 <p><strong>Affected:</strong> npm: happy-dom</p> <p>### Summary</p> <p>A code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization.</p> <p>### Details</p> <p>**Vulnerable file**: `packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts`, lines 371-385</p> <p>The &#34;Export object&#34; handler extracts content from `export { ... }` using the regex `export\s*{([^}]+)}`, then generates executable code by directly interpolating it:</p> <p>} else if (match[16] &amp;&amp; isTopLevel &amp;&amp; PRECEDING_STATEMENT_TOKEN_REGEXP.test(precedingToken)) { // Export object const parts = this.removeMultilineComments(match[16]).split(/\s*,\s*/); const exportCode: string[] = []; for (const part of parts) { const nameParts = part.trim().split(/\s+as\s+/); const exportName = (nameParts[1] || nameParts[0]).replace(/[&#34;&#39;]/g, &#39;&#39;); const importName = nameParts[0].replace(/[&#34;&#39;]/g, &#39;&#39;); // backticks NOT stripped if (exportName &amp;&amp; importName) { exportCode.push(`$happy_dom.exports[&#39;${exportName}&#39;] = ${importName}`); // importName is inserted as executable code, not as a string…</p> <p><strong>Affected:</strong> npm: happy-dom</p> <p>### Summary</p> <p>A code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization.</p> <p>### Details</p> <p>**Vulnerable file**: `packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts`, lines 371-385</p> <p>The &#34;Export object&#34; handler extracts content from `export { ... }` using the regex `export\s*{([^}]+)}`, then generates executable code by directly interpolating it:</p> <p>} else if (match[16] &amp;&amp; isTopLevel &amp;&amp; PRECEDING_STATEMENT_TOKEN_REGEXP.test(precedingToken)) { // Export object const parts = this.removeMultilineComments(match[16]).split(/\s*,\s*/); const exportCode: string[] = []; for (const part of parts) { const nameParts = part.trim().split(/\s+as\s+/); const exportName = (nameParts[1] || nameParts[0]).replace(/[&#34;&#39;]/g, &#39;&#39;); const importName = nameParts[0].replace(/[&#34;&#39;]/g, &#39;&#39;); // backticks NOT stripped if (exportName &amp;&amp; importName) { exportCode.push(`$happy_dom.exports[&#39;${exportName}&#39;] = ${importName}`); // importName is inserted as executable code, not as a string…</p> https://cve.radiocsirt.org/vuln/ghsa-6q6h-j7hj-3r64