# happy-dom sandbox escape RCE: CVE-2025-61927 (VM escape) and CVE-2025-62410 (prototype pollution)

> Two code-execution flaws in the happy-dom headless browser package let untrusted JavaScript escape the Node.js vm context. CVE-2025-61927 abuses the Function constructor chain to reach process and require(); CVE-2025-62410 uses prototype pollution to defeat the --disallow-code-generation-from-strings mitigation. Public PoCs exist; no in-the-wild exploitation is reported.

- **Published:** 2026-10-12T15:25:29Z
- **Last reviewed:** 2026-10-12T15:25:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3367
- **ID:** TL-2026-3367
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-61927, CVE-2025-62410

## Description

happy-dom (github.com/capricorn86/happy-dom) is a headless DOM implementation used for server-side rendering, scraping and test runners. It evaluates page JavaScript inside a Node.js vm context. Node.js documents the vm module as not a security mechanism, so any untrusted script executed this way shares the host process and its V8 isolate.

CVE-2025-61927 (CWE-94) affects happy-dom before 20.0.0, where JavaScript evaluation is enabled by default. Untrusted script walks the constructor chain (this.constructor.constructor) to reach the host-realm Function constructor, creates a function outside the vm context that returns the process object, then calls process.mainModule.require to load Node.js core modules. The Endor Labs PoC enumerates the working directory with require('fs').readdirSync. The GitHub advisory lists the impact as access to environment variables and secrets, arbitrary command execution through child processes, full file system read/write and network access for lateral movement. The reporter credited in the advisory is Mas0nShi. The fix in v20 disables JavaScript evaluation by default; the interim workaround was to run Node.js with --disallow-code-generation-from-strings.

CVE-2025-62410 (CWE-1321) affects happy-dom before 20.0.2 and is an incomplete fix for the first flaw. Even with code generation from strings disabled, untrusted script and the host application still share one isolate. The script can pollute built-in prototypes (the Endor Labs PoC overwrites toString on the root Object prototype via this.constructor.constructor.__proto__.__proto__) to cause denial of service, hijack critical references or control flow, or reach injection-prone APIs through gadget chains. The credited reporter is Cris Staicu of the Endor Labs research team. Node.js --frozen-intrinsics hardens the builtins but the maintainers and researchers still consider it insufficient: untrusted code can still exfiltrate data via fetch() or side channels, so real isolation (isolated-vm, a container or a VM, or Secure EcmaScript) is recommended.

Scoring differs between sources. NVD lists CVE-2025-61927 at 7.2 (CVSS 4.0) and CVE-2025-62410 at 9.4 (CVSS 4.0), while the GitHub advisories carry different severity labels; the highest sourced score and its vector are recorded here. The vendor advisories and Endor Labs report no in-the-wild exploitation, IOCs or threat actor attribution. The exposure applies to applications that run untrusted or third-party JavaScript through happy-dom, such as scrapers, SSR pipelines and AI-agent browsing tools.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059.007 JavaScript
- T1106 Native API
- T1005 Data from Local System
- T1499.004 Application or System Exploitation

## Sources

- [Happier DOMs: The perils of running untrusted JavaScript code outside of a web browser (Endor Labs)](https://www.endorlabs.com/learn/happier-doms-the-perils-of-running-untrusted-javascript-code-outside-of-a-web-browser)
- [GHSA-37j7-fg3j-429f: happy-dom VM Context Escape (CVE-2025-61927)](https://github.com/capricorn86/happy-dom/security/advisories/GHSA-37j7-fg3j-429f)
- [GHSA-qpm2-6cq5-7pq5: happy-dom --disallow-code-generation-from-strings insufficient isolation (CVE-2025-62410)](https://github.com/capricorn86/happy-dom/security/advisories/GHSA-qpm2-6cq5-7pq5)
- [NVD: CVE-2025-61927](https://nvd.nist.gov/vuln/detail/CVE-2025-61927)
- [NVD: CVE-2025-62410](https://nvd.nist.gov/vuln/detail/CVE-2025-62410)
- [happy-dom fix commit for CVE-2025-61927](https://github.com/capricorn86/happy-dom/commit/819d15ba289495439eda8be360d92a614ce22405)
- [happy-dom fix commit for CVE-2025-62410](https://github.com/capricorn86/happy-dom/commit/f4bd4ebe3fe5abd2be2bcea1c07043c8b0b70eea)
- [happy-dom project repository](https://github.com/capricorn86/happy-dom)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3367