Happy DOM EUVD-2026-109189

Exploitation requires that the application set enableJavaScriptEvaluation:true (NOT the default) and pass attacker-controlled HTML or ESM module source into Happy DOM - e.g. SSR, preview, scraping or testing services that evaluate externally supplied HTML. The concrete trigger is a named ESM import alias that is not a valid JavaScript binding identifier (e.g. missing as injected = <expression>) combined specifically with a JSON module import attribute with { type: 'json' }; per the advisory the JSON attribute is required because it stops the malicious alias from being re-emitted in the ESM circular-import resolver, keeping the generated function syntactically valid, and backtick strings survive the compiler's quote stripping so the injected initializer can reach host APIs. Limiting factors: default deployments (JS evaluation disabled) are not exploitable, the attacker must be able to get module source processed, and affected versions are 17.0.0 through 21.0.3 - upgrading to 21.0.4 removes the path.

This is a genuine high-severity remote code execution flaw (CWE-94) rather than an inflated CVSS score, but its real-world urgency is strongly gated by a non-default configuration. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity, unauthenticated issue with full confidentiality, integrity and availability impact because the injected expression runs in the Node.js host process. Those impact metrics are well supported: the GHSA advisory includes a complete, tested proof-of-concept that reaches node:process and node:fs and creates a directory on the host. Signals are mixed on likelihood: there is NO CISA KEV entry and NO EPSS score in the input, so there is no evidence of active or widespread exploitation, and the vuln.today Decision label is 'this_week' (not act_now/emergency). The dominant limiting factor is that exploitation requires enableJavaScriptEvaluation:true, which is not the default, plus the application must feed attacker-controlled HTML/module source to Happy DOM - so the exploitable population is narrower than AV:N/PR:N alone suggests. Net: treat as a prompt (this-week) patching priority for any SSR, preview, scraping or test service that evaluates externally supplied HTML, and as low urgency where JS evaluation is disabled. Note the official vector's UI:R reflects that an application must process attacker content; for fully automated services that ingest untrusted HTML there may be no genuine human interaction, which would make real risk slightly higher than the 8.8 implies.

A service (SSR renderer, link-preview generator, web scraper, or test harness) runs Happy DOM with enableJavaScriptEvaluation:true and processes attacker-supplied HTML containing a <script type="module">. The attacker crafts a named ESM import alias that is invalid JavaScript syntax but, combined with a JSON import attribute (with { type: 'json' }), the compiler rewrites it into a valid destructuring default initializer that executes, reaching node:process and node:fs for host code execution. A complete, tested public PoC exists in the GHSA advisory.