Loading vulnerability…
Happy DOM VM Context Escape RCE
CVE-2025-61927 is a critical remote code execution vulnerability in Happy DOM affecting version 19 and earlier. Happy DOM uses a Node.js VM Context for JavaScript evaluation, but that context is not a true security boundary. When untrusted JavaScript is executed inside the Happy DOM VM Context, an attacker can escape the sandbox and reach process-level functionality. Reported exploitation involves traversing the JavaScript constructor/inheritance chain to obtain the global Function constructor, enabling arbitrary code string evaluation outside the intended isolation boundary. In CommonJS deployments, successful escape can expose the require() function and permit loading of Node.js modules; in ESM contexts, access may still extend to sensitive process-level objects. The issue is exacerbated by the fact that JavaScript evaluation is enabled by default in affected versions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in remote code execution in the Node.js process hosting Happy DOM. Depending on runtime configuration, an attacker may gain access to require(), process, and imported Node.js capabilities, enabling arbitrary command execution, file system access, theft of environment variables, configuration files, and secrets, modification or persistence on the host, and potentially network-based follow-on activity or lateral movement from the compromised application context.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, disable JavaScript evaluation in Happy DOM unless all processed content is fully trusted. Avoid executing untrusted JavaScript or rendering untrusted/user-controlled HTML in environments where script execution is enabled. As an additional hardening measure, run Node.js with the --disallow-code-generation-from-strings flag to block eval()/Function()-style string-based code generation at the process level.
Patch, then assume compromise.
Upgrade Happy DOM to version 20.0.0 or later. The patch changes JavaScript evaluation to be disabled by default and adds warnings for potentially insecure enablement scenarios. Any deployment processing untrusted or user-controlled content should prioritize upgrading immediately.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.