EUVD-2026-109245

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3...

Happy DOM: Incomplete Fix For CVE-2026-33943: Unsanitized Import Alias Leads To Host Code Execution

Summary The ESM compiler in "[email protected]" does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to...

WordPress Better Messages cross-site scripting vulnerability

WordPress Better Messages versions 3.1.3 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation and may lead to DOM-based cross-site scripting attacks...

PT-2026-122523

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3...

07-calito-router (>=0.0.2, <=0.0.4), @01.software/cli (>=0.3.0, <=0.10.3) +906 more potentially affected by CVE-2026-115895 via happy-dom (>=17.1.0, <=21.0.3)

happy-dom NPM version =17.1.0, =0.0.2, =0.3.0, =0.4.0, =0.45.2, =0.2.0, =0.2.0, =0.1.5, =0.1.0, =0.2.1 and more Source cves: CVE-2026-115895 Source advisory: SNYK:JS-HAPPYDOM-21691240...

Arbitrary Code Injection

Overview happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Arbitrary Code Injection via the ESM compiler...

Arbitrary Code Injection

Overview org.webjars.npm:happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Arbitrary Code Injection via the ESM compiler...

CVE-2026-115895

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it in...

GHSA-834V-8H66-3H79 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Summary The ESM compiler in [email protected] does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to b...

07-calito-router (>=0.0.2, <=0.0.4), @01.software/cli (>=0.3.0, <=0.10.3) +906 more potentially affected by CVE-2026-115895 +1 more via happy-dom (>=17.1.0, <=21.0.3)

happy-dom NPM version =17.1.0, =0.0.2, =0.3.0, =0.4.0, =0.45.2, =0.2.0, =0.2.0, =0.1.5, =0.1.0, =0.2.1 and more Source cves: CVE-2026-115895, CVE-2026-33943 Source advisory: GHSA-834V-8H66-3H79...

npm: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

npm: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution vulnerability discovered by ? in WordPress npm happy-dom versions = 17.0.0, = 21.0.3...

07-calito-router (>=0.0.2, <=0.0.4), @01.software/cli (>=0.3.0, <=0.10.3) +906 more potentially affected by CVE-2026-115895 via happy-dom (>=17.1.0, <=21.0.3)

happy-dom NPM version =17.1.0, =0.0.2, =0.3.0, =0.4.0, =0.45.2, =0.2.0, =0.2.0, =0.1.5, =0.1.0, =0.2.1 and more Source cves: CVE-2026-115895 Source advisory: OSV:GHSA-834V-8H66-3H79...

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Summary The ESM compiler in [email protected] does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to b...

CVE-2026-115895

A flaw was found in happy-dom. This vulnerability allows an attacker to achieve arbitrary code execution within the host Node.js environment. When JavaScript evaluation is enabled, the module compiler fails to validate named ECMAScript Module ESM import aliases before inserting them into generate...

EUVD-2026-109189

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it in...

CVE-2026-115895

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it in...

@akairos/pipeline (>=0.24.0, <=0.24.1), @webiny/ai-powerups (>=6.5.0-beta.13, <=6.5.1-beta.0) +2 more potentially affected by CVE-2026-115895 via happy-dom (21.0.3)

happy-dom NPM version 21.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on happy-dom and may be impacted: - @akairos/pipeline =0.24.0, =6.5.0-beta.13, =6.5.0-beta.13, =6.5.0-beta.13, =6.5.1-beta.0 Source cves: CVE-2026-115895 Source advisory:...

CVE-2026-115895 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it in...

CVE-2026-115895 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it in...

CVE-2026-115895

The happy-dom library (versions 17.0.0 through 21.0.4 ) is vulnerable to host code execution due to an incomplete fix for CVE-2026-33943. The flaw exists in packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts, where the compiler fails to validate named ESM import aliases before inserting th...