CVE-2025-62410 - CVE House

Back to Database

Status published Critical CVE-2025-62410

--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom

9.4 CVSS

Vulnerability Description

In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62410

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from capricorn86

View All →

Happy-DOM has VM Context Escape

Fixes security vulnerability that allowed for server side code to be executed by a <script> tag

Affected Vendor

capricorn86

View all reports →

Affected Software

happy-dom

Vulnerable Versions:

< 20.0.2

Timeline

Official Publish: October 15th, 2025

Last Modified: October 15th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.