happy-dom CVE-2025-62410

Requires the embedding application to run happy-dom's Browser/ServerRenderer with JavaScript evaluation enabled (settings.enableJavaScriptEvaluation:true, as shown in the PoC) and to process untrusted/attacker-controlled script content. The prior mitigation --disallow-code-generation-from-strings is explicitly insufficient because the untrusted script shares the same V8 Isolate/process as the application, allowing prototype pollution to hijack references like process. Limiting factors: JavaScript evaluation of untrusted input is NOT a default/typical configuration, which substantially narrows exposed deployments; the attacker also depends on the app passing attacker-controlled markup into the DOM. The fix adds --frozen-intrinsics to the worker, so unpatched (>=19.0.0,<20.0.2) versions remain exploitable regardless.

This is a genuinely severe vulnerability by technical impact - prototype pollution (CWE-1321) that defeats happy-dom's sandboxing and yields arbitrary OS command execution in the host Node.js process - but the real-world risk is moderated by its narrow preconditions. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, 9.4 Critical) with full High impact on both the vulnerable system (VC/VI/VA:H) and subsequent systems (SC/SI/SA:H) reflects a sandbox-escape-to-RCE, consistent with the published PoC. However, exploitation is gated on the application explicitly enabling JavaScript evaluation (settings.enableJavaScriptEvaluation:true) AND feeding happy-dom untrusted script - a non-default, specialized deployment. This explains the LOW EPSS score (0.35%, 27th percentile) and the absence from CISA KEV: publicly available exploit code exists, but the signals point to opportunistic/targeted risk against the specific subset of deployments that run untrusted JS, not broad mass exploitation. The one data tension worth flagging: the vendor vector sets PR:L and UI:P, yet the actual attacker (the author of the untrusted script) holds no credentials - the 'privilege' is really an operator-side configuration precondition, so raw CVSS arguably overstates ease relative to how rarely that config is used. Note also this is an incomplete fix for CVE-2025-61927, so environments that only applied the prior --disallow-code-generation-from-strings mitigation remain exposed until upgrading to 20.0.2.

An application uses happy-dom's Browser or ServerRenderer with JavaScript evaluation enabled to render attacker-influenced HTML (e.g., server-side rendering of user content or processing scraped/untrusted pages). The attacker embeds a prototype-pollution payload that poisons builtins (e.g., Object.prototype.hasOwnProperty) to recover a reference to Node's process object, then invokes process.binding('spawn_sync') to execute arbitrary OS commands. A working proof-of-concept is published in the GHSA-qpm2-6cq5-7pq5 advisory.