EXECUTIVE SUMMARY:
A critical remote-code-execution vulnerability CVE-2025-61927, CVSS 9.4 in Happy DOM — a widely used headless DOM implementation with 2.7M weekly downloads — allows untrusted scripts running inside the library’s Node.js VM context to escape to the host process (Happy DOM v19 and lower are affected), potentially giving attackers access to process-level objects, modules, files and enabling arbitrary command execution, data exfiltration, lateral movement and persistence.
RECOMMENDATION:
We strongly recommend you update Happy DOM to version 20.
REFERENCES:
The following reports contain further technical details: