CVE•Published 2026-03-27•Modified 2026-06-30•1 article on news•6 live references•NVD data

CVE-2026-33943Capricorn86 · Happy_dom

Vulnerability data via NVD (ingested)

CVSS v3.1

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS percentile

—

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Description

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside `export { }` declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content into generated code as an executable expression, and the quote filter does not strip backticks, allowing template literal-based payloads to bypass sanitization. Version 20.8.8 fixes the issue.

Timeline

Published 2026-03-27

Modified 2026-06-30

External references

NVD MITRE Exploit-DB GitHub PoC Sploitus VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2026-33943

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product

product:"Capricorn86 Happy Dom"

All exposed Capricorn86 Happy Dom instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Happy Dom"

HTTP body or banner mentions "Happy Dom" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2026-33943