Описание
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
Summary
A code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside export { } declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization.
Details
Vulnerable file: packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts, lines 371-385
The "Export object" handler extracts content from export { ... } using the regex export\s*{([^}]+)}, then generates executable code by directly interpolating it:
The issue has three root causes:
STATEMENT_REGEXPuses{[^}]+}which matches any content inside braces, not just valid JavaScript identifiers- The captured
importNameis placed in code context (as a JS expression to evaluate), not in string context .replace(/["']/g, '')strips"and'but not backticks, so template literal strings like`child_process`survive the filter
Attack flow:
Note: This is a different vulnerability from CVE-2024-51757 (SyncFetchScriptBuilder injection) and CVE-2025-61927 (VM context escape). Those were patched in v15.10.2 and v20.0.0 respectively, but this vulnerable code path in ECMAScriptModuleCompiler remains present in v20.8.4 (latest). In v20.0.0+ where JavaScript evaluation is disabled by default, this vulnerability is exploitable when JavaScript evaluation is explicitly enabled by the user.
PoC
Standalone PoC script — reproduces the vulnerability without installing happy-dom by replicating the compiler's exact code generation logic:
Execution result:
HTML attack vector — when processed by happy-dom with JavaScript evaluation enabled:
Impact
An attacker who can inject or control HTML content processed by happy-dom (with JavaScript evaluation enabled) can achieve arbitrary command execution on the host system.
Realistic attack scenarios:
- SSR applications: Applications using happy-dom to render user-supplied HTML on the server
- Web scraping: Applications parsing untrusted web pages with happy-dom
- Testing pipelines: Test suites that load untrusted HTML fixtures through happy-dom
Suggested fix: Validate that importName is a valid JavaScript identifier before interpolating it into generated code:
Пакеты
happy-dom
>= 15.10.0, <= 20.8.7
20.8.8
Связанные уязвимости
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.