SB2026111225 - Code Injection in Happy DOM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111225

SB2026111225 - Code Injection in Happy DOM

Published: November 12, 2026

Security Bulletin ID SB2026111225
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Code Injection (CVE-ID: CVE-2026-115895)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code with the privileges of the Happy DOM host process.

The vulnerability exists due to improper control of code generation in the Happy DOM ESM compiler when unvalidated import aliases are interpolated into JavaScript with JavaScript evaluation enabled. A remote attacker can induce a victim to process module source containing a malicious import alias and with { type: 'json' } to execute a destructuring default initializer that accesses Node.js host APIs, enabling file access, environment disclosure, and operating-system command execution.


Remediation

Install update from vendor's website.

References