Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

影響: npm:happy-dom >= 17.0.0, <= 21.0.3 → 21.0.4

The ESM compiler in happy-dom@20.14.5 does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates importName in the local export { ... } handler, but the named import handler still pl…

GitHub Advisory Databaseで読む

2026/10/24 07:06、GitHub Advisory Databaseが「Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-115895。