CVE-2026-33943 Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
Attackers can achieve remote code execution by injecting malicious JavaScript into ES module export declarations processed by the Happy DOM library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33943?
CVE-2026-33943 is a high-severity code injection vulnerability in capricorn86 happy-dom, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.
Which versions are affected by CVE-2026-33943?
2 open source packages ship an affected version, including happy-dom. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
happy-dom npm | From 15.10.0 | 20.8.8 |
happy-dom npm | From 15.10.0 | 20.8.8 |
Products include Capricorn86 Happy Dom.
How do I fix CVE-2026-33943?
Upgrade happy-dom to 20.8.8 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-33943 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33943 exists.
Other vulnerabilities in capricorn86 happy-dom
Sources
Also known as GHSA-6q6h-j7hj-3r64.