CVE-2026-115895

## Summary The ESM compiler in `[email protected]` does not validate imported local binding aliases before interpolating them into generated JavaScript. As a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed. This appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates `importName` in the local `export { ... }` handler, but the named import handler still places an unvalidated `alias` directly into code context. These issues were confirmed through the public `Window` and `<script type="module">` APIs using the published `happy-dom` npm package. The PoC reaches the Node.js host `process`, obtains `node:fs`, and creates a proof directory on the host filesystem. ## Confirmed affected versions The PoC was directly tested against: - `[email protected]` - `[email protected]` - `[email protected]` - `[email protected]` The same PoC does not trigger on `[email protected]`. The ESM compiler was introduced by commit `7bc831df2`, first released in `v17.0.0`. The vulnerable interpolation remains present through `v20.14.5`, the latest release at the time of testing. Suggested affected range: ```text >= 17.0.0, <= 20.14.5 ``` No patched version is currently available. ## Preconditions - JavaScript evaluation is enabled with `enableJavaScriptEvaluation: true`. - Attacker-controlled HTML or module source is processed by Happy DOM. - This may affect SSR, preview, scraping, or testing services that evaluate externally supplied HTML. ## Technical details In `packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts`, the named import handler splits an import specifier and extracts its alias: ```ts const nameParts = part.trim().split(/\s+as\s+/); const alias = (nameParts[1] || nameParts[0]).replace(/["']/g, ''); const name = nameParts[0].replace(/["']/g, ''); if (alias && name) { properties.push({ name, alias }); } `