Happy DOM: VM Context Escape can lead to Remote Code Execution

Description

No description available.

Recommendation

Update the happy-dom package to the latest compatible version. Followings are version details:

Affected version(s): < 20.0.0
Patched version(s): 20.0.0

References

Could your website be exposed too?

SmartScanner can check your website for Happy DOM: VM Context Escape can lead to Remote Code Execution and gives you actionable findings to investigate.

Start a free scan

Related Issues

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution - CVE-2026-115895
happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript - CVE-2025-62410
Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages - CVE-2025-59417
OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment - CVE-2026-41900

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated October 13, 2025