Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2026-33943 is a high-severity Code Injection (CWE-94) vulnerability in Capricorn86 Happy Dom. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Happy DOM, a JavaScript implementation of a web browser without a graphical user interface, contains a code injection vulnerability in its ECMAScriptModuleCompiler component affecting versions 15.10.0 through 20.8.7. The flaw, tracked as CVE-2026-33943 and associated with CWE-94, enables remote code execution (RCE) by allowing attackers to inject arbitrary JavaScript expressions within `export { }` declarations in ES module scripts processed by Happy DOM. This occurs because the compiler directly interpolates unsanitized content into generated code as executable expressions, while the quote filter fails to strip backticks, permitting template literal-based payloads to bypass sanitization.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no required privileges, and user interaction, resulting in high impacts to confidentiality, integrity, and availability without scope changes. An attacker can exploit it by supplying malicious ES module scripts to applications or environments that process content with vulnerable Happy DOM versions, such as Node.js-based tools for DOM simulation, testing frameworks, or server-side rendering setups. Successful exploitation leads to arbitrary JavaScript execution within the context of the Happy DOM instance.
Mitigation is available via an update to version 20.8.8, which addresses the issue as detailed in the project's GitHub security advisory (GHSA-6q6h-j7hj-3r64), release notes, and the fixing commit (5437fdf8f13adb9590f9f52616d9f69c3ee8db3c). Security practitioners should audit dependencies for vulnerable Happy DOM versions and apply the patch promptly, particularly in automated testing pipelines or headless browser emulation scenarios.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16864
Vulnerability Data
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions…
more
inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.2V1.3.2V1.3.5V4.3.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation finds code paths that accept and execute externally influenced strings.
Input validation directly stops untrusted data from being used to construct executable code without neutralization.
Least privilege limits the damage an injected code fragment can perform once executed.
Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.
Security engineering principles include requirements for safe construction and sanitization of dynamic statements, structurally preventing expression-language injection at design time.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly target injection flaws via secure coding and testing (mostly), yet as a single broad outcome it leaves many code-generation specifics unaddressed (partial).
PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect EL injection but does not itself implement the fix.
Secure SDLC mandates input validation and output encoding that directly prevent expression-language injection.
Application security requirements explicitly call for controls against injection flaws including EL injection.
Secure architecture principles reduce the attack surface but do not prescribe the specific neutralization techniques needed.
Banning unapproved code samples and unauthenticated web services, combined with secure-coding standards and SAST, prevents the dynamic generation or inclusion of attacker-supplied code.
Controls that restrict unauthorized or malicious code from being introduced via external networks or removable media limit opportunities for an attacker to inject and execute arbitrary code.