Critical severity · published Mar 27, 2026
CVE-2026-33943
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
happy-dom · capricorn86
>= 15.10.0, < 20.8.8 · source: vendor
HD
Happy Dom · Capricorn86
15.10.0 before 20.8.8 · source: NVD
RH
Red Hat OpenShift Container Platform 4 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33943
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33943
Patch
https://github.com/capricorn86/happy-dom/commit/5437fdf8f13adb9590f9f52616d9f69c3ee8db3c
Product
https://github.com/capricorn86/happy-dom/releases/tag/v20.8.8
Exploit
https://github.com/capricorn86/happy-dom/security/advisories/GHSA-6q6h-j7hj-3r64
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-33943
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2452522
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33943.json
More from happy-dom
9.4
CVE-2025-62410
--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom
9.3
CVE-2024-51757
Fixes security vulnerability that allowed for server side code to be executed by a <script> tag
8.8
CVE-2026-115895
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
8.6
CVE-2026-118660
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
7.5
CVE-2026-118659
@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy