3 matches found
Happy DOM: Incomplete Fix For CVE-2026-33943: Unsanitized Import Alias Leads To Host Code Execution
Summary The ESM compiler in "[email protected]" does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to...
GHSA-834V-8H66-3H79 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
Summary The ESM compiler in [email protected] does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to b...
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
Summary The ESM compiler in [email protected] does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to b...