PUBLISHED
2025-10-15 18:15
MODIFIED
2025-10-16 15:28
EPSS (Prob. Exploit)
0.36%
Top 70.0%
> DESCRIPTION
In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> RED HAT SEVERITY ASSESSMENT
THREAT SEVERITY
Important
> GITHUB SECURITY ADVISORY
GHSA-qpm2-6cq5-7pq5
CRITICAL
happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript
AFFECTED PACKAGES:
NPM / happy-dom
>= 19.0.0, < 20.0.2
Fixed in: 20.0.2
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom
AFFECTED PACKAGES:
Unknown / Unknown
409 versions affected
ALIASES:
GHSA-qpm2-6cq5-7pq5
> HISTORIQUE DES MODIFICATIONS
Première apparition
15/10/2025 18:15
Source: NVD
📊
ENRICHISSEMENT
19/10/2025 04:01
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{
"severity_scale": null,
"threat_severity": "Important"
}
Nouvelle valeur:
{
"threat_severity": "Important",
"severity_scale": null
}
📊
ENRICHISSEMENT
18/10/2025 15:08
CVEPROJECT
Champ modifié: CVE Project
📊
ENRICHISSEMENT
18/10/2025 12:02
REDHAT
Champ modifié: Sévérité Red Hat
Nouvelle valeur:
{
"threat_severity": "Important",
"severity_scale": null
}
📊
ENRICHISSEMENT
18/10/2025 12:02
REDHAT
Total des modifications: 4
Dernière mise à jour: 1 year ago