RCE in Capricorn86 Happy-Dom
CVE-2026-33943
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.010 (60.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 60.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.010 · change: +0.002
Affected products
- Capricorn86 Happy-Dom — versions >= 15.10.0, < 20.8.8
- Capricorn86 Happy Dom
Weakness classification (CWE)
References
- github.com/capricorn86/happy-dom/security/advisories/GHSA-6q6h-j7hj-3r64 (Exploit, Vendor Advisory)
- github.com/capricorn86/happy-dom/commit/5437fdf8f13adb9590f9f52616d9f69c3ee8db3c (Patch)
- github.com/capricorn86/happy-dom/releases/tag/v20.8.8 (Product, Release Notes)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Frequently asked questions
- What is CVE-2026-33943?
- CVE-2026-33943 is a high-severity vulnerability in Capricorn86 Happy-Dom, classified under Code Injection. CVSS score: 8.8/10. Published 2026-03-27.
- How severe is CVE-2026-33943?
- High severity. CVSS v3 base score is 8.8 out of 10.