-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| happy-dom | npm | < 20.0.0 | 20.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability in Happy DOM is a classic VM escape caused by the improper use of eval() within a Node.js vm context. By default, JavaScript evaluation was enabled, and several functions across the library used eval() to execute script code from various sources (inline scripts, external scripts, javascript: URLs, and event handlers).
The core of the issue is that the eval function provided within the Happy DOM window object was not properly sandboxed. Malicious JavaScript code could abuse this by walking up the constructor chain (e.g., this.constructor.constructor('return process')()) to gain access to the Function constructor of the parent Node.js process. This escape from the vm sandbox allows the attacker to access the process object, require(), and other Node.js internals, leading to Remote Code Execution (RCE).
The identified vulnerable functions are the specific locations in the codebase where these insecure eval() calls were made. During an exploit, a stack trace would likely show one of these functions calling the eval function. The patch addresses the vulnerability by replacing all instances of eval() with a new, safer method ([PropertySymbol.evaluateScript]) that uses vm.Script.runInContext(). Additionally, the patch disables JavaScript evaluation by default, making the library secure out-of-the-box and requiring developers to consciously opt-in to the potentially risky feature.
Ongoing coverage of React2Shell