CVE-2026-33943: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33943 is a code injection vulnerability in the ECMAScriptModuleCompiler component of happy-dom, a JavaScript implementation of a web browser without a graphical user interface. It allows an attacker who can inject or control HTML content processed by happy-dom (with JavaScript evaluation enabled) to achieve arbitrary Remote Code Execution (RCE) on the host system. Affected versions are happy-dom >= 15.10.0 and <= 20.8.7 (npm package). The vulnerability was disclosed on March 24, 2026, and patched in version 20.8.8 released the same day. The GitHub Advisory Database assigns a CVSS v3.1 score of 8.8 (High), while Feedly's estimate places it at 9.8 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-94: Improper Control of Generation of Code) lies in ECMAScriptModuleCompiler.ts (lines 371–385), where the "Export object" handler extracts content from export { ... } blocks using the regex export\s*{([^}]+)} and directly interpolates the captured importName into generated JavaScript code as an executable expression — not as a string. The sanitization filter only strips double and single quotes (.replace(/["']/g, '')), but does not strip backticks, allowing template literal payloads like require(`child_process`).execSync(`id`) to survive and be executed when evaluateScript() processes the generated code. Exploitation requires the attacker to supply or influence HTML/ES module content processed by happy-dom with JavaScript evaluation explicitly enabled (disabled by default in v20.0.0+). A public PoC (poc_happy_dom_rce.js) is available in the security advisory that reproduces the vulnerability by replicating the compiler's code generation logic (GitHub Advisory, Patch Commit).

Successful exploitation grants an attacker arbitrary command execution on the host system with the privileges of the application process running happy-dom. This results in full compromise of confidentiality, integrity, and availability — an attacker can read sensitive files, modify data, install backdoors, or disrupt service. Realistic affected environments include server-side rendering (SSR) applications processing user-supplied HTML, web scraping tools parsing untrusted pages, and CI/CD testing pipelines loading untrusted HTML fixtures through happy-dom (GitHub Advisory, Red Hat Bugzilla).

A standalone proof-of-concept exploit (poc_happy_dom_rce.js) is publicly available in the GitHub security advisory, demonstrating RCE by executing child_process.execSync('id') and returning root-level output (GitHub Advisory). As of the time of reporting, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.075–0.085%, indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog.

1. Identify a target application: Locate an application using happy-dom versions 15.10.0–20.8.7 with JavaScript evaluation explicitly enabled — such as an SSR web app, web scraper, or test pipeline that processes external or user-supplied HTML.
2. Craft a malicious ES module payload: Construct an HTML page or script containing a <script type="module"> block with a malicious export {} declaration using backtick template literals to bypass the quote filter:

   <script type="module">
   export { require(`child_process`).execSync(`id`) }
   </script>

3. Deliver the payload: Supply the malicious HTML to the target application — e.g., via a form submission in an SSR app, a scraped web page, or an injected HTML fixture in a test pipeline.
4. Trigger happy-dom processing: The application passes the HTML to happy-dom with JavaScript evaluation enabled. The ECMAScriptModuleCompiler regex captures the export block content and interpolates the unsanitized importName directly into generated code.
5. Achieve RCE: The generated code $happy_dom.exports["require(child_process).execSync(id)"] = require(child_process).execSync(id) is executed by evaluateScript(), running the injected command on the host system with the application process's privileges (GitHub Advisory).

• Logs: Application logs showing unexpected JavaScript evaluation errors or unusual output from happy-dom's script execution engine; Node.js process logs containing output resembling OS command results (e.g., uid=, gid=, groups=).
• Process: Unexpected child processes spawned by the Node.js application process (e.g., sh, bash, id, whoami, curl, wget) — particularly via child_process.execSync or child_process.exec.
• Network: Outbound connections from the Node.js server process to unexpected external hosts, potentially indicating reverse shell or data exfiltration activity following RCE.
• File System: New or modified files in the application directory or system directories created by the Node.js process; unexpected cron jobs, SSH keys, or scripts added by the application user account.
• Application Input: Presence of ES module export { ... } blocks containing backtick expressions (e.g., require(`child_process`)) in user-supplied HTML, scraped content, or test fixtures processed by happy-dom (GitHub Advisory).

Upgrade happy-dom to version 20.8.8 or later, which validates that importName matches a strict JavaScript identifier regex (/^[a-zA-Z_$][a-zA-Z0-9_$]*$/) before interpolating it into generated code (Release v20.8.8, Patch Commit). As a workaround for applications that cannot immediately upgrade, disable JavaScript evaluation in happy-dom (it is off by default in v20.0.0+) and avoid processing untrusted or user-supplied HTML content. Applications should also implement strict input validation to ensure only trusted HTML is passed to happy-dom when JavaScript evaluation is required (GitHub Advisory).

The vulnerability was reported by security researcher tndud042713 and acknowledged by the happy-dom maintainer (capricorn86), who released the patch on the same day as disclosure (March 24, 2026) (Release v20.8.8). Red Hat opened a tracking bug (Bugzilla #2452522) and classified it as high severity (Red Hat Bugzilla). Coverage appeared on The Hacker Wire and security aggregators including VulDB, cvefeed.io, and radar.offseq.com shortly after disclosure, indicating moderate community interest given the realistic attack scenarios involving SSR and testing pipelines.