Threat reportVulnerabilityTL-2026-3367
happy-dom sandbox escape RCE: CVE-2025-61927 (VM escape) and CVE-2025-62410 (prototype pollution)
happy-dom sandbox escape RCE (TL-2026-3367) is a critical-severity software vulnerability scored CVSS 9.4, first published 2026-10-12. It has no confirmed attribution, affects capricorn86 happy-dom (npm), references 2 CVEs (CVE-2025-61927, CVE-2025-62410), maps to 6 MITRE ATT&CK techniques (T1005, T1059.007, T1106), and is covered by 9 detection rules and 4 indicators of compromise.
- CVSS
- 9.4/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 4Indicators of compromise
Key facts for TL-2026-3367
- Threat ID
- TL-2026-3367
- Severity
- CRITICAL
- CVSS
- 9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, cloud-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 4
How happy-dom sandbox escape RCE works
Two code-execution flaws in the happy-dom headless browser package let untrusted JavaScript escape the Node.js vm context. CVE-2025-61927 abuses the Function constructor chain to reach process and require(); CVE-2025-62410 uses prototype pollution to defeat the --disallow-code-generation-from-strings mitigation. Public PoCs exist; no in-the-wild exploitation is reported.
happy-dom (github.com/capricorn86/happy-dom) is a headless DOM implementation used for server-side rendering, scraping and test runners. It evaluates page JavaScript inside a Node.js vm context. Node.js documents the vm module as not a security mechanism, so any untrusted script executed this way shares the host process and its V8 isolate.
CVE-2025-61927 (CWE-94) affects happy-dom before 20.0.0, where JavaScript evaluation is enabled by default. Untrusted script walks the constructor chain (this.constructor.constructor) to reach the host-realm Function constructor, creates a function outside the vm context that returns the process object, then calls process.mainModule.require to load Node.js core modules. The Endor Labs PoC enumerates the working directory with require('fs').readdirSync. The GitHub advisory lists the impact as access to environment variables and secrets, arbitrary command execution through child processes, full file system read/write and network access for lateral movement. The reporter credited in the advisory is Mas0nShi. The fix in v20 disables JavaScript evaluation by default; the interim workaround was to run Node.js with --disallow-code-generation-from-strings.
CVE-2025-62410 (CWE-1321) affects happy-dom before 20.0.2 and is an incomplete fix for the first flaw. Even with code generation from strings disabled, untrusted script and the host application still share one isolate. The script can pollute built-in prototypes (the Endor Labs PoC overwrites toString on the root Object prototype via this.constructor.constructor.__proto__.__proto__) to cause denial of service, hijack critical references or control flow, or reach injection-prone APIs through gadget chains. The credited reporter is Cris Staicu of the Endor Labs research team. Node.js --frozen-intrinsics hardens the builtins but the maintainers and researchers still consider it insufficient: untrusted code can still exfiltrate data via fetch() or side channels, so real isolation (isolated-vm, a container or a VM, or Secure EcmaScript) is recommended.
Scoring differs between sources. NVD lists CVE-2025-61927 at 7.2 (CVSS 4.0) and CVE-2025-62410 at 9.4 (CVSS 4.0), while the GitHub advisories carry different severity labels; the highest sourced score and its vector are recorded here. The vendor advisories and Endor Labs report no in-the-wild exploitation, IOCs or threat actor attribution. The exposure applies to applications that run untrusted or third-party JavaScript through happy-dom, such as scrapers, SSR pipelines and AI-agent browsing tools.
MITRE ATT&CK techniques used in TL-2026-3367
Collection
Execution
T1059.007 JavaScript; T1106 Native API; T1203 Exploitation for Client Execution
Initial Access
T1190 Exploit Public-Facing Application
Impact
Affected products and versions in happy-dom sandbox escape RCE
- capricorn86 — happy-dom (npm)
Vulnerable versions: < 20.0.0 (CVE-2025-61927); < 20.0.2 (CVE-2025-62410)
Fixed in: 20.0.0; 20.0.2
Remediation for happy-dom sandbox escape RCE
Patches
- happy-dom 20.0.0 (CVE-2025-61927)
- happy-dom 20.0.2 (CVE-2025-62410)
Immediate actions
- Upgrade happy-dom to 20.0.2 or later (v20 disables JavaScript evaluation by default; 20.0.2 fixes CVE-2025-62410)
- Disable JavaScript evaluation in happy-dom for any content that is not fully trusted
- Inventory applications and CI pipelines that run untrusted or third-party JavaScript through happy-dom
Workarounds
- Start Node.js with --disallow-code-generation-from-strings (insufficient alone against prototype pollution)
- Start Node.js with --frozen-intrinsics to block builtin alteration (still not full isolation)
Longer-term hardening
- Run untrusted JavaScript in genuinely isolated runtimes such as isolated-vm or Secure EcmaScript instead of the Node.js vm module
- Add container or VM isolation, least-privilege service accounts and egress filtering around workloads that render untrusted pages
- Keep secrets out of the environment of processes that execute untrusted scripts
CVEs associated with happy-dom sandbox escape RCE
Weaknesses (CWE) in happy-dom sandbox escape RCE
Timeline of happy-dom sandbox escape RCE
- happy-dom 20.0.0 patches CVE-2025-61927 by disabling JavaScript evaluation by default; interim guidance for older versions was to disable evaluation or run Node.js with --disallow-code-generation-from-strings
- happy-dom publishes GHSA-37j7-fg3j-429f for CVE-2025-61927 (VM context escape, reported by Mas0nShi); v20 is the patched release with JavaScript evaluation disabled by default
- NVD publishes CVE-2025-61927 (CWE-94), affecting happy-dom before 20.0.0
- NVD publishes CVE-2025-62410 (CWE-1321), affecting happy-dom before 20.0.2
- happy-dom 20.0.2 fixes CVE-2025-62410, an incomplete fix for CVE-2025-61927; advisory PoC shows prototype pollution reaching the process object and spawnSync() despite eval restrictions
- happy-dom publishes GHSA-qpm2-6cq5-7pq5 for CVE-2025-62410, showing --disallow-code-generation-from-strings is insufficient against prototype pollution; fixed in 20.0.2 (reported by Cris Staicu of Endor Labs)
- Endor Labs publishes 'Happier DOMs', analyzing both vulnerabilities with two public PoCs and recommending isolated-vm, Secure EcmaScript, or container/VM isolation
Sources cited for happy-dom sandbox escape RCE
- Happier DOMs: The perils of running untrusted JavaScript code outside of a web browser (Endor Labs)
- GHSA-37j7-fg3j-429f: happy-dom VM Context Escape (CVE-2025-61927)
- GHSA-qpm2-6cq5-7pq5: happy-dom --disallow-code-generation-from-strings insufficient isolation (CVE-2025-62410)
- NVD: CVE-2025-61927
- NVD: CVE-2025-62410
- happy-dom fix commit for CVE-2025-61927
- happy-dom fix commit for CVE-2025-62410
- happy-dom project repository
Detection coverage for TL-2026-3367
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3367 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.