A critical code injection vulnerability in the Happy DOM library allows unauthenticated remote attackers to execute arbitrary code on systems processing malicious ES module scripts.

This flaw exists within the ECMAScriptModuleCompiler, where unsanitized content is directly interpolated into generated code. An unauthenticated attacker can bypass existing quote filters by using template literal-based payloads to inject and execute arbitrary JavaScript.

The ability to achieve Remote Code Execution (RCE) represents the highest level of security risk, potentially granting an attacker full control over the application environment. With a CVSS score of 8.8, this vulnerability poses a severe threat to data confidentiality, integrity, and system availability. Successful exploitation could lead to total system compromise, unauthorized data exfiltration, or the deployment of persistent malware within the development or production pipeline.

Immediate Action: Update the happy-dom dependency to version 20.8.8 or later immediately to incorporate the necessary sanitization logic.

Proactive Monitoring: Monitor application logs for unusual module processing errors or unexpected outbound network connections originating from environments utilizing Happy DOM.

Compensating Controls: Implement strict Content Security Policies (CSP) and input validation for any user-supplied content that may be processed by Happy DOM, although these should be viewed as secondary to the required version update.

Public Exploit Available: No (exploit_available: unknown).

Given the critical impact of Remote Code Execution and the existence of a proof-of-concept, organizations must prioritize the update of Happy DOM to version 20.8.8. Review all projects utilizing this library to ensure the patch is applied across the entire development lifecycle, as failure to remediate leaves the infrastructure exposed to full system compromise.