PT-2025-41599 · Happy-Dom · Happy-Dom

Mas0Nshi · Published 2025-10-10 · Updated 2025-12-10 · CVE-2025-61927

Positive Technologies · (AI Summary)

CVSS v4.0

7.2

High

AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Happy DOM versions 19 and lower

Description Happy DOM, a JavaScript implementation of a web browser without a graphical user interface, contains a security issue that could lead to Remote Code Execution (RCE) attacks. The Node.js VM Context within Happy DOM is not fully isolated. Running untrusted JavaScript code within this context may allow it to escape the VM and gain access to process-level functionality. The extent of control an attacker gains depends on whether the process uses ESM or CommonJS. With CommonJS, an attacker can potentially access the require() function to import modules. JavaScript evaluation is enabled by default in Happy DOM, which may pose a risk if untrusted code is executed within the environment. Approximately 2.7 million weekly downloads are impacted.

Recommendations Upgrade to version 20.0.0 or later, which disables JavaScript evaluation by default.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-61927

GHSA-37J7-FG3J-429F

Affected Products

Happy-Dom

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61927.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-61927 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-37j7-fg3j-429f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61927 · Security Note
• https://github.com/capricorn86/happy-dom · Note
• https://github.com/capricorn86/happy-dom/commit/de438ad72921c69793584aa657b48d3655dfac97 · Note
• https://github.com/capricorn86/happy-dom/releases/tag/v20.0.0 · Note
• https://github.com/capricorn86/happy-dom/security/advisories/GHSA-37j7-fg3j-429f · Note
• https://github.com/capricorn86/happy-dom/commit/819d15ba289495439eda8be360d92a614ce22405 · Note
• https://t.me/pentestingnews/69449 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1o6h2pg/resumen_diario_de_vulnerabilidades_14102025 · Reddit Post
• https://twitter.com/fridaysecurity/status/1977526705305845944 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o42xq1/resumen_diario_de_vulnerabilidades_11102025 · Reddit Post
• https://twitter.com/wvipersg/status/1978031429155000417 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o5knot/resumen_diario_de_vulnerabilidades_13102025 · Reddit Post