CVE-2025-62410CWE-1321

CVE-2025-62410

published October 15, 2025

CVSS
9.4
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.

The record
Technical detail
CVSS
9.4 · NONE
CVSS v4.0
Not supplied
EPSS
0.00352 · 27.6th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2025-10-15T22:15Z
References (2)
https://github.com/capricorn86/happy-dom/commit/f4bd4ebe3fe5abd2be2bcea1c07043c8b0b70eea · [email protected]https://github.com/capricorn86/happy-dom/security/advisories/GHSA-qpm2-6cq5-7pq5 · [email protected]
EPSS history
Timeline
  • 15 OCT 17:16Z
    --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom
    cvelistv5