PT-2025-41599 · Happy-Dom · Happy-Dom

Mas0Nshi · Publicado 2025-10-10 · Atualizado 2025-12-10 · CVE-2025-61927

Positive Technologies (AI Summary)

CVSS v4.0

7.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Happy DOM versions 19 and lower

Description Happy DOM, a JavaScript implementation of a web browser without a graphical user interface, contains a security issue that could lead to Remote Code Execution (RCE) attacks. The Node.js VM Context within Happy DOM is not fully isolated. Running untrusted JavaScript code within this context may allow it to escape the VM and gain access to process-level functionality. The extent of control an attacker gains depends on whether the process uses ESM or CommonJS. With CommonJS, an attacker can potentially access the require() function to import modules. JavaScript evaluation is enabled by default in Happy DOM, which may pose a risk if untrusted code is executed within the environment. Approximately 2.7 million weekly downloads are impacted.

Recommendations Upgrade to version 20.0.0 or later, which disables JavaScript evaluation by default.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2025-61927

GHSA-37J7-FG3J-429F

Produtos afetados

Happy-Dom

Referências · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61927.json · Exploit
• https://github.com/capricorn86/happy-dom · Nota
• https://github.com/capricorn86/happy-dom/commit/de438ad72921c69793584aa657b48d3655dfac97 · Nota
• https://github.com/capricorn86/happy-dom/releases/tag/v20.0.0 · Nota
• https://github.com/capricorn86/happy-dom/security/advisories/GHSA-37j7-fg3j-429f · Nota
• https://github.com/capricorn86/happy-dom/commit/819d15ba289495439eda8be360d92a614ce22405 · Nota
• https://t.me/pentestingnews/69449 · Publicação no Telegram
• https://reddit.com/r/VulnMatter/comments/1o6h2pg/resumen_diario_de_vulnerabilidades_14102025 · Publicação no Reddit
• https://twitter.com/fridaysecurity/status/1977526705305845944 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1o42xq1/resumen_diario_de_vulnerabilidades_11102025 · Publicação no Reddit
• https://osv.dev/vulnerability/CVE-2025-61927 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-37j7-fg3j-429f · Aviso do Fabricante
• https://twitter.com/wvipersg/status/1978031429155000417 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1o5knot/resumen_diario_de_vulnerabilidades_13102025 · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61927 · Nota de Segurança