Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
影響: npm:happy-dom >= 17.0.0, <= 21.0.3 → 21.0.4
The ESM compiler in happy-dom@20.14.5 does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates importName in the local export { ... } handler, but the named import handler still pl…
| CVE | CVE-2026-115895 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 24. 오후 01:50 |
| 데이터 | Markdown JSON |
2026. 10. 24. 오전 07:06, GitHub Advisory Database에서 "Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-115895.