Code injection via unsanitized export names in happy-dom ECMAScriptModuleCompiler (CVE-2026-33943)

A code injection vulnerability in the `ECMAScriptModuleCompiler` component of happy-dom allows an attacker to inject arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts. The compiler interpolates unsanitized content directly into generated executable code, and its quote-stripping filter does not remove backticks, enabling template literal payloads to bypass sanitization. An attacker who can control HTML content processed by happy-dom with JavaScript evaluation enabled can achieve arbitrary command execution on the host system. Affected versions: - >= 15.10.0, <= 20.8.7 We recommend updating to: 20.8.8. CVSS 9.8 · our assessment: act_now Reference: https://github.com/capricorn86/happy-dom/security/advisories/GHSA-6q6h-j7hj-3r64 Details: https://vuln.today/cve/CVE-2026-33943