{"id":"ghsa-ghsa-834v-8h66-3h79","seq":661296,"kind":"advisory","title":"Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution","url":"https://github.com/advisories/GHSA-834v-8h66-3h79","permalink":"https://vulnpulse.app/items/ghsa-ghsa-834v-8h66-3h79","summary":"影響: npm:happy-dom >= 17.0.0, <= 21.0.3 → 21.0.4\nThe ESM compiler in happy-dom@20.14.5 does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates importName in the local export { ... } handler, but the named import handler still pl…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-115895"],"tags":["GHSA-834v-8h66-3h79","happy-dom"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:06:13.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}