SB2025121631 - Prototype pollution in Happy DOM

Description

This security bulletin contains information about 1 vulnerability.

1) Prototype pollution (CVE-ID: CVE-2025-62410)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application, bypass the --disallow-code-generation-from-strings option and perform prototype pollution, which can result in information disclosure or data manipulation.

Note, the vulnerability exists due to incomplete fix for #VU120001 (CVE-2025-61927).

Remediation

Install update from vendor's website.

References

• https://github.com/capricorn86/happy-dom/commit/f4bd4ebe3fe5abd2be2bcea1c07043c8b0b70eea
• https://github.com/capricorn86/happy-dom/security/advisories/GHSA-qpm2-6cq5-7pq5